Scrubbing tokens from source code is not enough, as shown by the publishing of a Python Software Foundation access token with administrator privileges to a container image on Docker Hub.

Malicious packages are targeting Python devs againFurthermore, the researchers believe this to be the same group that was behind a similar attack that was first reported earlier this month by ...