If you see references to "OIDC publishing" in the context of PyPI, this is what they're referring to. This example jumps right into the current best practice. If you want to use API tokens directly or ...

The administrators of the Python Package Index (PyPI) repository have quarantined the package "aiocpa" following a new update that included malicious code to exfiltrate private keys via Telegram. By ...