A malicious version of element-data CLI (0.23.3) was pushed to PyPI and Docker Hub via a compromised GitHub Actions workflow, stealing credentials for ~12 hours.
Attackers exploited a vulnerability in a GitHub Action maintained by the element-data developers, allowing them to inject a bash script into the developer's account via a pull request. This gave them access to signing keys and account tokens, which they used to publish malicious version 0.23.3 to PyPI and Docker Hub. The package scraped user profiles, cloud provider keys, API tokens, warehouse credentials, and SSH keys. The malicious package was live for approximately 12 hours before removal; Elementary Cloud and the Elementary dbt package were unaffected.
This is a textbook CI/CD supply chain attack via a poisoned pull request hitting a GitHub Actions workflow — the attacker never needed to breach a server directly. Any environment that installed 0.23.3 or ran the Docker image should be treated as fully compromised: cloud keys, SSH keys, API tokens, warehouse credentials. The 12-hour window is wide enough to have propagated into production pipelines.
Run `pip show element-data` in every environment this week — if the version shows 0.23.3, immediately revoke all credentials accessible from that environment (AWS IAM keys, Snowflake creds, SSH keys, API tokens) and audit CloudTrail or equivalent logs for unauthorized access.
Suggested exercise · not independently tested. Access requirements and costs may vary.
Open your terminal in any environment where element-data is installed
Run: pip show element-data && docker images | grep element-data
If version 0.23.3 appears or the Docker image was pulled between Friday and Saturday, document which credentials were accessible in that environment
Tags