2025 conda-forge — CVE-2025-31484 upload token leak
Data compromised
Upload token; potential package compromise
Technical writeup
anaconda.org upload token accidentally leaked Feb 10–Apr 1. CVE-2025-31484. No evidence of malicious uploads; artifact uploads temporarily shut down. conda-forge incident.
Root cause
Token leak; credential exposure