An attacker published a backdoored release of the popular elementary-data package (v0.23.3) to PyPI and pushed a malicious Docker image, stealing developer secrets and cryptocurrency wallets. The compromise exploited a GitHub Actions script-injection that exposed GITHUB_TOKEN to forge a signed release; a clean 0.23.4 was published but users who installed 0.23.3 remain at risk. #elementary-data #PyPI

Fake Python libraries on PyPI impersonate AI tools like GPT-4 and Claude, spreading JarkaStealer malware.