PyPI says it invalidated all PyPI tokens stolen from GitHub repos by a malicious action on September 5 in a supply attack known as GhostAction.
The PyPI team says none of the tokens were abused to upload malware to their registry.
Token Exfiltration Campaign via GitHub Actions Workflows - The Python Package Index Blog
Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.
(blog.pypi.org)
