Record · nesbitt.io
GitHub Actions security in Python packages
Andrew Nesbitt | Software Engineer and Package Management Nerd · 25 May 2026 · 16 min read
A post on nesbitt.io, published 25 May 2026, has not been cited by any blog yet (corpus.blog, measured 13 October 2026).
A record is what was published and who pointed at it. The text of the post is not shown here: read it at the source, or at its Wayback capture.
0blogs citing
| Period | Blogs | Links |
|---|---|---|
| All time | 0 | 0 |
| Last 90 days | 0 | 0 |
| Last 30 days | 0 | 0 |
| Last 7 days | 0 | 0 |
| Words blogs link it with | 0 |
|---|---|
| External links | 28 |
| Length | 3,650 |
Cited by
No blog we hold has cited this post yet.
Links from this post
Link
Host
docs.pypi.org
peps.python.org
peps.python.org
https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection?utm_source=https://ashishb.net&utm_medium=referral&utm_campaign=blog Who cites this page
blog.yossarian.net
docs.zizmor.sh
ecosyste.ms
A malicious version of elementary-data (0.23.3) was published to PyPI and is, at the time of writing, still listed as the latest release. The same release run also pushed a multi-arch container image to GitHub Container Registry at ghcr.io/elementary-data/elementary, tagged both 0.23.3 and latest." name="description"/><meta content= Read at stepsecurity.io (opens in a new tab)
peps.python.org
github.com
thanks.dev
https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 Who cites this page
wiz.io
https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction Who cites this page
cisa.gov
https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/?ref=traefik.io Who cites this page
securitylabs.datadoghq.com
On April 30, 2026, a supply chain compromise was identified in the lightning PyPI package — versions 2.6.2 and 2.6.3. The project’s GitHub account shows signs of compromise, with issues reporting the attack closed rapidly by suspicious responses." name="description"/><meta content= Read at stepsecurity.io (opens in a new tab)
https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-multi-ecosystem-supply-cha/ Who cites this page
labs.cloudsecurityalliance.org
Similar posts
7 Jul 2026
Publish packages to PyPI using Github Actions – Ashvanth.S Blog
ash-01xor.github.io
11 Aug 2026
8 Apr 2026
Is GitHub Actions Putting Your Software at Risk?
Atomic Object
10 Jun 2026
Introducing 'Trusted Publishers'
PyPI Blog
19 Aug 2026
18 Sept 2026
24 Jun 2026
Chainguard Actions is Generally Available: Hardening 1,000+ GitHub Actions and removing transitive CI/CD risks
Chainguard Blog
6 Oct 2026
Pycon NL: Using PyPI trusted publishing for ansible releases - Anwesha Das
Reinout van Rees' personal website
11 Aug 2026
24 Sept 2026
Something wrong here? Report a problem