Malicious elementary-data package version 0.23.3 steals developer data and cryptocurrency wallets

As reported by Bleeping Computer, a malicious version of the popular elementary-data Python package, version 0.23.3, was pushed to the Python Package Index (PyPI) and GitHub Container Registry, designed to steal sensitive developer data and cryptocurrency wallets.

The attack exploited a GitHub Actions script injection flaw, allowing the attacker to inject shell code that exposed a GitHub token. This token was then used to forge a signed commit and tag, triggering the project's legitimate release pipeline. The compromised pipeline built and published the backdoored package and a malicious Docker image. The malicious release contained a file, elementary.pth, which executed at startup to steal SSH keys, Git credentials, cloud credentials, Kubernetes and Docker secrets, developer tokens, cryptocurrency wallet files, and system data. The same payload was present in the Docker image.

Researchers advise users who downloaded the malicious version or images to rotate all secrets and restore their environments from a known safe state. The vulnerability was discovered by community member crisperik, and a clean replacement, elementary-data 0.23.4, was quickly released.

Source: Bleeping Computer