PyPI and Shai-Hulud: Staying Secure Amid Emerging Threats November 28, 2025 Python Software Foundation PyPI warns developers about the Shai-Hulud npm supply chain campaign, revoking exposed tokens and recommending trusted publishers, CI workflow audits, and token rotation.
