Open source package with 1 million monthly downloads stole user credentials

2026-04-29

Attackers abused a GitHub Actions flaw in the element-data project to steal signing keys, then shipped a malicious 0.23.3 release that exfiltrated warehouse credentials, cloud keys, API tokens, SSH keys, and env contents before it was removed about 12 hours later. Affected users should install 0.23.4, check for the trinny marker file, purge caches, and rotate exposed secrets.