GitHub Token Leak Exposes Python's Core Repositories to Potential Attacks

Researchers discovered an accidentally leaked GitHub Personal Access Token embedded in a public Docker container that could have allowed an attacker to modify Python core repositories and PyPI packages; the token was revoked after responsible disclosure and there is no evidence of exploitation. In addition, Checkmarx found malicious PyPI packages (testbrojct2, proxyfullscraper, proxyalhttp, proxyfullscrapers) that scan for files and exfiltrate data to a Telegram bot linked to cybercriminal operations, indicating active infostealer malware on the package registry.