GHSA-5xjx-3w67-w9x9 - pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI
### Summary
The [pypi-publish action][pypi-publish] versions before 1.14.2 used to bundle the `emSign` root CA trust store certificate through the `certifi` distribution. It has since been removed through the bundle and the new version no longer includes them.
[pypi-publish]: https://github.com/marketplace/actions/pypi-publish
### Details
The `certifi`-provided TLS trust store is typically used by many projects in the Python ecosystem, including Sigstore that [pypi-publish] relies on for Trusted Publishing and Digital Attestations.
### Related
The external compromise is being tracked at https://emudhra.we-have-a-problem.com
CRITICAL
Severity & confidence
Source severitycritical
Platform severitycritical
Confidencemedium
Exploitationunknown
CVSS-
Affected
Vendorspypa
Productspypa/gh-action-pypi-publish
Reporting sources (1)
GitHub Security Advisories
Timeline & provenance
Published2026-10-30T20:24:24
Last updated2026-11-09T10:07:19
Ingested2026-10-30T20:31:40
FreshnessNEAR-REAL-TIME
Threat typeadvisory
Recommended action
Review the advisory and upgrade affected packages to the first patched version.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a single or secondary source; treat as indicative, verify before acting.
Source type: vendor ยท Original: GitHub Security Advisories
