elementary-data PyPI and GHCR releases forged

Between April 24 and 25, 2026, an attacker forged a release of elementary-data, an open-source data-observability tool used in dbt pipelines, by exploiting a script-injection flaw in one of the project's own GitHub Actions workflows. No maintainer ever pushed the bad version; the project's CI did it on the attacker's behalf.

The entry point was a pull-request comment. According to StepSecurity, which reverse-engineered the incident alongside Elementary's own post-mortem, the project ran an issue-update workflow that interpolated comment text directly into a shell run: block, so a crafted comment let the attacker execute arbitrary commands inside the workflow with the repository's GITHUB_TOKEN. From there, the attacker used that token to create an orphan commit, tag it v0.23.3, and add a large elementary.pth file along with a version bump. Python evaluates .pth files at interpreter startup, so the payload would fire without any explicit import elementary in the victim's code. The attacker then dispatched the project's normal release workflow against the forged tag. PyPI accepted elementary-data==0.23.3, and GHCR accepted a multi-architecture ghcr.io/elementary-data/elementary image tagged both 0.23.3 and latest, all signed off by the project's own automation.

The payload was a credential stealer of the kind familiar from the broader spring 2026 wave. It walked the host for SSH keys, cloud credentials, Kubernetes config, package-manager tokens, cryptocurrency wallets, and other secrets, then posted an archive named trin.tar.gz to igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud.

Elementary pulled the bad release, rotated affected credentials, and published a clean 0.23.4. The incident is a textbook example of how a single ${{ github.event.comment.body }} interpolated into a shell step can hand an outsider the same publish authority a maintainer holds.