---
id: 1663
title: "Trusted publishing: a new benchmark for packaging security"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/"
published_at: "2023-05-23T11:00:20Z"
tags: ["supply-chain", "pypi", "authentication", "python", "package-management", "supply-chain-security", "trusted-publishing", "oidc", "credential-management", "ecosystem-security"]
phying_url: "https://phying.com/item/1663"
lang: en
---

# Trusted publishing: a new benchmark for packaging security

## Summary

Trail of Bits partnered with PyPI on trusted publishing, an OIDC-based auth method that removes long-lived API tokens, cutting supply chain attack and credential leak risks in package releases.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2023-05-23T11:00:20Z
- **Original:** https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/
- **Phying News:** https://phying.com/item/1663