Contradiction?
Contradiction?
Posted Jun 10, 2026 18:26 UTC (Wed) by samlh (subscriber, #56788)In reply to: Contradiction? by jzb
Parent article: Eliminating long-lived credentials with trusted publishing
Also of note:
In response to a similar (the same?) attack, crates.io's implementation now proactively blocks usage with the pull_request_target trigger server-side, so that particular footgun is defanged for Rust crates.
Perhaps PyPI could do the same?
In response to a similar (the same?) attack, crates.io's implementation now proactively blocks usage with the pull_request_target trigger server-side, so that particular footgun is defanged for Rust crates.
Perhaps PyPI could do the same?
Reference:
https://github.com/rust-lang/crates.io/blob/c61947f573026...