“In our case, the user had admin access to the core repositories of Python’s infrastructure, including Python Software Foundation (PSF), PyPI, the Python language and CPython.”
A classic GitHub token with admin rights over 91 python, 55 pypa, 42 psf and 21 pypi repositories sat in a public Docker Hub image. The developer deleted it from the source and shipped the compiled .pyc that still held it. PyPI revoked it 17 minutes after JFrog reached out. The headline doubles as an ad for JFrog’s binary scanner.