Embed Notice

lottiefiles/lottie-player on NPM just yesterday had its publishing API tokens stolen and used to publish malware.

If you're using API tokens to publish to @pypi from GitHub Actions, GitLab CI/CD, Google Cloud Build, or ActiveState: please upgrade to Trusted Publishers to prevent these sorts of attacks.

#security #oss #opensource #python

https://docs.pypi.org/trusted-publishers/