Loading story…
Attackers abused a script-injection flaw in the elementary-data project's GitHub Actions workflow to forge a signed 0.23.3 release and publish trojanized artifacts to both PyPI and GitHub Container Registry. The malicious package and matching container images used an elementary.pth file to execute automatically and deploy a multi-stage infostealer that targeted SSH keys, Git and developer credentials, AWS, GCP, and Azure secrets, Kubernetes and Docker data, CI/CD tokens, .env files, database credentials, shell histories, system information, and cryptocurrency wallet material. Researchers said the attacker exposed the repository GITHUB_TOKEN, created a forged commit and tag, and triggered the legitimate release pipeline without compromising maintainer accounts or altering the main branch.
Community member crisperik flagged the malicious release, after which maintainers removed the poisoned PyPI package and GHCR images, released clean version 0.23.4, and removed the vulnerable workflow for further review. Organizations that installed elementary-data 0.23.3 or pulled the affected container images were urged to uninstall and replace the package, clear caches, check for the malware marker file, rotate all accessible secrets, and rebuild or restore impacted developer and CI environments from a known safe state.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
The Elementary Python CLI project disclosed that version 0.23.3 was malicious and said attackers had compromised its GitHub Actions release workflow. The project also removed the vulnerable workflow and audited other workflows for similar script injection issues.
After the malicious 0.23.3 release was identified, maintainers published version 0.23.4 as a clean replacement and advised users to uninstall 0.23.3 and rotate exposed secrets. Multiple reports describe 0.23.4 as the safe version to pin and restore from.
On April 25, 2026, community members reported and confirmed the compromise, after which the Elementary team removed the malicious PyPI package and GHCR images. The incident was tied to exploitation of a GitHub Actions script injection flaw that exposed the repository's GITHUB_TOKEN and enabled a forged signed release.
On April 25, 2026, community member crisperik opened a GitHub issue warning that release 0.23.3 contained a Base64-encoded elementary.pth file that executed during installation. The report flagged the release as a likely supply-chain compromise.
A trojanized release of elementary-data version 0.23.3 was published to PyPI on April 24, 2026, and matching malicious container images were pushed to GitHub Container Registry under the 0.23.3 and latest tags. The forged release was produced through the project's legitimate release pipeline after abuse of a GitHub Actions workflow.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceitpro.com
Open sourcearstechnica.com
Open sourcebleepingcomputer.com
Open sourceelementary-data.com
Open sourcestepsecurity.io
Open sourceopennet.me
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a large-scale automated supply chain attack dubbed **Megalodon** that pushed **5,718 malicious commits** into **5,561 GitHub repositories** in less than six hours, using forged CI/CD bot identities and benign-looking commit messages to slip in malicious GitHub Actions workflow files. The workflows requested elevated permissions and carried base64-encoded bash payloads that executed after maintainers merged the changes, harvesting CI/CD environment data, cloud credentials, SSH keys, Docker and Kubernetes secrets, Vault and Terraform credentials, GitHub OIDC tokens, and other source-code and developer secrets. Investigators said the stolen data was exfiltrated over HTTP POST requests to **`216.126.225[.]129:8443`**, with two workflow variants observed, including payloads labeled **SysDiag** and **Optimize-Build**. The most visible downstream impact was a compromise of the **Tiledesk** repository, where a malicious workflow change led to the publication of poisoned **`@tiledesk/tiledesk-server`** npm versions **`2.18.6`** through **`2.18.12`**. Reporting tied the activity to a broader pattern of software supply chain abuse associated with **TeamPCP**, whose earlier incidents affected major open-source and commercial projects and prompted npm to invalidate some write-capable granular access tokens that could bypass 2FA protections. Security firms urged organizations to review repositories for unauthorized workflow changes, block the identified command-and-control infrastructure, rotate exposed secrets and keys, and inspect cloud and CI logs for signs of credential theft or cloud impersonation.
Jun 29, 2026
A large software supply-chain campaign dubbed **Mini Shai-Hulud** compromised more than 170 npm packages and at least two PyPI packages tied to projects including **TanStack, Mistral AI, OpenSearch, UiPath, Guardrails AI,** and others. Researchers and vendors attributed the activity to **TeamPCP**, saying the attackers abused GitHub Actions release workflows—especially `pull_request_target`, cache poisoning, and theft of short-lived **OIDC** material from runners—to publish trojanized packages with apparently legitimate **SLSA** provenance, Sigstore attestations, and trusted-publishing signatures. Reports variously counted between roughly 160 and 400+ malicious package versions, with some affected packages totaling hundreds of millions of downloads, and OpenSearch and Mistral both confirmed compromised releases while TanStack described a chained workflow attack on its publishing pipeline. The malware targeted developer workstations and CI/CD systems, stealing **npm**, **GitHub**, cloud, Kubernetes, Vault, SSH, Docker, and AI-tool credentials, then attempting worm-like propagation by republishing infected packages with stolen tokens or workflow-issued publish credentials. Investigators said the payload also established persistence through **VS Code** tasks, **Claude Code** hooks, and in some cases system services, while exfiltrating data through **Session**, GitHub dead drops, and other attacker infrastructure; some variants included extortion notes, dead-man-switch logic, and geofenced destructive behavior. Defenders were urged to treat hosts that installed affected versions as potentially fully compromised, remove persistence before revoking tokens where applicable, rotate all exposed secrets from clean systems, invalidate CI caches, audit lockfiles and publishing activity, and rebuild impacted environments from trusted sources.
Jul 12, 2026
The **GhostAction** supply-chain campaign compromised 327 GitHub users and inserted malicious workflows into 817 repositories, stealing 3,325 CI/CD secrets. Workflows masquerading as “Github Actions Security” sent PyPI, npm, DockerHub, GitHub, AWS, database, and Cloudflare credentials by HTTP POST to attacker infrastructure, including `45.139.104.115`; a later wave added exfiltration domains and hundreds of commits. Although no malicious package releases had been confirmed at disclosure, 24 affected packages—nine npm and 15 PyPI—remained at immediate risk, while some stolen credentials were reportedly already abused. CI/CD workflows are also vulnerable to remote-code-execution exposure from unsafe `pull_request_target` configurations, artifact-token leaks such as **ArtiPACKED**, and attacks including **HackerBot-Claw**. Elastic Security Labs released the open-source `cicd-abuse-detector` to review GitHub Actions, GitLab CI, and Azure DevOps changes before merge or deployment, extracting more than 50 signals from pipeline files and analyzing diffs for secret exfiltration, privileged pull-request triggers, permission escalation, self-hosted-runner targeting, supply-chain manipulation, and timestamp abuse. The tool can issue pull-request, issue, Slack, and Elasticsearch alerts and optionally block risky pull requests.
Sep 9, 2026