“The second round of malicious releases came from the attacker using an unrevoked PyPI API token that was still available to the GitHub Actions workflow, potentially a hold-over from before the project adopted Trusted Publishing.”
Four Ultralytics releases on PyPI shipped malware, first through a poisoned GitHub Actions cache and then through an old API token nobody revoked. Trusted Publishing let investigators trace the first wave. It did nothing to stop the second, because the legacy token still worked alongside it. PyPI says it is up to users to review packages before installing them. Nobody reviews a dependency that has been fine for years.