Malicious Python package poses new supply chain threat
Briefly

Malicious Python package poses new supply chain threat
"Attackers exploited a vulnerability in a GitHub Actions workflow to steal signing keys and publish a malicious version of elementary-data, which was available for about twelve hours."
"The malicious version of elementary-data actively searched for user profiles, warehouse credentials, cloud keys, API tokens, SSH keys, and the contents of .env files."
"Research by ReversingLabs shows that the number of malicious open-source packages has risen by 73 percent in 2026, indicating a troubling trend in software security."
The open-source package elementary-data, with over a million monthly downloads, was compromised through a GitHub Actions vulnerability. Attackers published a malicious version, 0.23.3, which was available for about twelve hours. This version contained code that searched for sensitive user data, including API tokens and SSH keys. Users are advised to rotate their credentials immediately. Such attacks have become common, with a 73 percent increase in malicious open-source packages reported in 2026, following similar incidents in the past year.
#open-source #cybersecurity #malware #github-actions #sensitive-data
Read at Techzine Global
Unable to calculate read time
[
|
]