Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers

A Python package on PyPI called elementary-data , with over 1 million downloads per month, has suffered a supply chain security attack sourced through a GitHub Actions attack vector. TL;DR Advisory SNYK-PYTHON-ELEMENTARYDATA-16316110 Severity Critical (CVSS v4.0: 9.3) Affected package elementary-data==0.23.3 Clean versions All versions except 0.23.3 ; upgrade to 0.23.4 Attack type Supply chain (GitHub Actions CI/CD injection, then credential-stealing package) Stolen credentials dbt profiles, Sno