Last Friday, a threat actor pushed a malicious version of element-data—a CLI tool with over a million monthly downloads used for monitoring ML system performance—after exploiting a vulnerability in the developers’ GitHub Actions workflow. The attacker gained access to signing keys and account tokens, then published version 0.23.3 to PyPI and Docker Hub. The package remained live for roughly 12 hours before being pulled.

When executed, the compromised package exfiltrated user profiles, warehouse credentials, cloud provider keys, API tokens, and SSH keys from the host environment. The attack vector: a malicious pull request that triggered a bash script inside the developer’s GitHub Actions runner, leaking environment variables and secrets. With those tokens, the attacker signed and published a nearly indistinguishable package.

The developers learned of the breach from a third-party report, rotated all exposed credentials, fixed the vulnerable action, and audited their remaining actions for similar flaws. Elementary Cloud, the dbt package, and other CLI versions were unaffected.

For engineering teams: this incident underscores a hard truth—your CI/CD pipeline is a supply chain attack surface. Assume any runner with access to production signing keys is a potential pivot point. Consider short-lived, scoped tokens, mandatory approval gates on pull requests from forked repos, and runtime credential scanning. If you pulled version 0.23.3, rotate everything that environment could see.

Source: Ars Technica