open-source security software supply chain attack element-data breach credential theft Python Package Index Docker security machine learning security API token compromise SSH key exposure cloud provider keys

A critical security incident has been uncovered involving an open source software package with more than 1 million monthly downloads. Threat actors exploited a vulnerability in the developers’ account workflow to gain access to signing keys and other sensitive information.

On Friday, unknown attackers leveraged this vulnerability to push a malicious version of element-data, a command-line interface (CLI) tool designed to monitor performance and anomalies in machine-learning systems.

When executed, the compromised package, tagged as 0.23.3, scanned systems for sensitive data, including:

  • User profiles
  • Warehouse credentials
  • Cloud provider keys
  • API tokens
  • SSH keys

The malicious version was published to the developers’ Python Package Index and Docker image accounts. It was removed approximately 12 hours later, on Saturday. Notably, Elementary Cloud, the Elementary dbt package, and all other CLI versions remained unaffected.

Immediate Action Required for Users

“Users who installed 0.23.3, or who pulled and ran the affected Docker image, should assume that any credentials accessible to the environment where it ran may have been exposed,” the developers warned.
Source: Ars Technica
2007 Mazda MX-5 Transformed into Aston Martin Lookalike by Simpson Design
← Previous

2007 Mazda MX-5 Transformed into Aston Martin Lookalike by Simpson Des...

 Jeffries Stands Firm on 'Maximum Warfare' Remark Amid GOP Backlash Over Redistricting Rhetoric
Next →

Jeffries Stands Firm on 'Maximum Warfare' Remark Amid GOP Backlash Ove...