TLDR Tech / IT
You shouldn't trust Trusted Publishing
PyPI's “Trusted Publishing” should not be treated as a signal that a package is safe or high quality. Trusted Publishing is only an authentication mechanism that ties CI/CD machine identities to publishing on an index, and anyone can still use it to upload malicious or vulnerable code.
Read the full story