Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Elementary-data package hit by network compromise

Incident
First reported
Last updated
Happening score
H score 36
1 unique sources, 1 articles

Summary

Hide ▲

The elementary-data project suffered a malicious release compromise that exposed users of PyPI and GitHub Container Registry to a backdoored package and image. An attacker abused a GitHub Actions script injection flaw to obtain the project’s GITHUB_TOKEN, forge a signed v0.23.3 release, and trigger the legitimate pipeline. The booby-trapped release dropped elementary.pth at startup to steal SSH keys, Git credentials, cloud creds, Kubernetes/Docker/CI secrets, .env files, developer tokens, and crypto wallet files. A clean 0.23.4 release replaced the malicious version, but systems that pulled elementary-data==0.23.3 or the :0.23.3 and :latest images remained compromised.

Related Happenings

Cursor Windows repo-root git.exe code execution security flaw

Vulnerability
H score9 First: 15.07.2026 13:55 Last: 15.07.2026 13:55 Sources 1

About this happening: Cursor on Windows automatically runs a repo-root git.exe when a repository is opened, creating arbitrary code execution as the logged-in user. The flaw affects cloned...

Open Happening

Jscrambler 8.14.0 malicious preinstall infostealer release

Malware Activity
H score9 First: 11.07.2026 20:59 Last: 11.07.2026 20:59 Sources 1

About this happening: The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...

Open Happening

OpenMandriva Linux project hit by cyberattack

Incident
H score32 First: 10.07.2026 01:14 Last: 10.07.2026 01:14 Sources 1

About this happening: The OpenMandriva Linux project is recovering from an attempted internal sabotage that deleted repositories and published an empty package that could have damaged user...

Open Happening

Injective Labs SDK project GitHub repository hit by network compromise

Incident
H score21 First: 09.07.2026 23:10 Last: 09.07.2026 23:10 Sources 1

About this happening: The Injective Labs SDK project suffered a GitHub repository compromise that let attackers publish a malicious @injectivelabs/sdk-ts v1.20.21 package, putting developer...

Open Happening

Operation Navy Ghost PyPI supply-chain campaign

Campaign
H score26 First: 01.07.2026 00:02 Last: 01.07.2026 00:02 Sources 1

About this happening: The Operation Navy Ghost campaign has targeted Python developers building Telegram bots through trojanized Pyrogram forks, creating a supply-chain path to compromi...

Open Happening

Timeline

  1. 27.04.2026 18:17 2 articles · 2mo ago

    Malicious elementary-data 0.23.3 release disclosed

    Initial Disclosure

    A malicious elementary-data 0.23.3 release was disclosed as having abused a GitHub Actions script injection flaw in the project’s release workflow, used the exposed GITHUB_TOKEN to forge a signed v0.23.3 tag, and published backdoored artifacts to PyPI and GitHub Container Registry. The package and Docker image carried elementary.pth to steal SSH keys, Git credentials, cloud creds, Kubernetes/Docker/CI secrets, .env files, developer tokens, and cryptocurrency wallet files, while a clean elementary-data 0.23.4 replacement was pushed and users of the compromised release and images were told to rotate secrets and restore from a known safe point.

    Show sources
    Open in new tab