PyPI Package With 1.1M Monthly Downloads Hacked to Push Infostealer

2026-04-29

The Python `elementary-data` package was compromised to steal developer data and cryptocurrency wallets. `elementary-data` is a popular data observability tool used by data engineers working with data pipelines. Researchers at StepSecurity state that the package was compromised via a malicious commit that exploited a GitHub Actions script-injection flaw.