The elementary-data PyPi package and associated GHCR container image were compromised by an unknown threat actor. Version 0.23.3 of the package is malicious, and the latest tag of the container image was redirected to point at a malicious commit, along with a newly added malicious 0.23.3 tag.
Technical Details
The compromise originated from a GitHub Actions script injection vulnerability in a workflow that improperly handled untrusted input from pull request comments. An attacker exploited this flaw to execute arbitrary commands within the CI pipeline, gaining access to the repository’s GITHUB_TOKEN. This allowed them to forge a signed commit and trigger the legitimate release pipeline, publishing elementary-data v0.23.3 to PyPI and corresponding container images to GHCR - without modifying the main branch or submitting a pull request.
The malicious package included a .pth file (elementary.pth) that executes automatically on Python interpreter startup. This file deployed a three-stage credential harvesting payload, leveraging layered obfuscation (base64 + XOR/MD5) to evade detection. The final payload collected sensitive data from local files and live cloud APIs, including SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes secrets, developer tokens, and crypto wallets. The data was compressed and exfiltrated via HTTP POST to a remote command-and-control (C2) domain. The same payload was embedded in the compromised GHCR container image, including the :latest tag—impacting environments using unpinned images.
Affected Products
-
elementary-data (PyPI)
-
Compromised:
0.23.3 -
Clean:
0.23.2(last known good),0.23.4(fixed release)
-
-
Container Images (GHCR)
-
ghcr.io/elementary-data/elementary:0.23.3 -
ghcr.io/elementary-data/elementary:latest(during exposure window)
-
Indicators of Compromise (IOCs)
Package: elementary-data==0.23.3
Container Image Package elementary · GitHub (Trojanized image)
Container Image Package elementary · GitHub (Malicious during exposure window)
Image Digest: sha256:31ecc5939de6d24cf60c50d4ca26cf7a8c322db82a8ce4bd122ebd89cf634255; multi-arch linux/amd64 + linux/arm64) Compromised multi-arch image
File: elementary.pth (Malicious execution file (~245KB base64 payload))
Git Commit: b1e4b1f3aad0d489ab0e9208031c67402bbb8480 (Forged release commit)
C2 Domain: igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud (Data exfiltration endpoint)
Header: X-Rise-To-The-Trinny: agree (Exfiltration header)
Archive: trin.tar.gz (Exfiltrated data bundle)
Temp File: $TMPDIR/.trinny-security-update (Persistence marker)
GitHub Actor: realtungtungtungsahur (Malicious account)