Token Exfiltration Campaign via GitHub Actions Workflows

Incident report of a recent attack campaign targeting GitHub Actions workflows to exfiltrate PyPI tokens, our response, and steps to protect your projects.