A malicious version of element-data CLI (0.23.3) was pushed to PyPI and Docker Hub via a compromised GitHub Actions workflow, stealing credentials for ~12 hours.
Attackers exploited a vulnerability in a GitHub Action maintained by the element-data developers, allowing them to inject a bash script into the developer's account via a pull request. This gave them access to signing keys and account tokens, which they used to publish malicious version 0.23.3 to PyPI and Docker Hub. The package scraped user profiles, cloud provider keys, API tokens, warehouse credentials, and SSH keys. The malicious package was live for approximately 12 hours before removal; Elementary Cloud and the Elementary dbt package were unaffected.
This is a textbook CI/CD supply chain attack via a poisoned pull request hitting a GitHub Actions workflow — the attacker never needed to breach a server directly. Any environment that installed 0.23.3 or ran the Docker image should be treated as fully compromised: cloud keys, SSH keys, API tokens, warehouse credentials. The 12-hour window is wide enough to have propagated into production pipelines.
Run `pip show element-data` in every environment this week — if the version shows 0.23.3, immediately revoke all credentials accessible from that environment (AWS IAM keys, Snowflake creds, SSH keys, API tokens) and audit CloudTrail or equivalent logs for unauthorized access.
Open your terminal in any environment where element-data is installed
Tags