{
  "title": "elementary-data PyPI and GHCR GitHub Actions Compromise",
  "summary": "A malicious `elementary-data==0.23.3` release was pushed to PyPI and GHCR after attackers exploited a GitHub Actions script-injection path, adding an interpreter-startup `.pth` infostealer.",
  "date": "2026-04-25",
  "severity": "critical",
  "tags": [
    "pypi",
    "github-actions",
    "ghcr",
    "supply-chain",
    "credential-theft"
  ],
  "sources_count": 6,
  "indicators": {
    "slug": "elementary-data-pypi-ghcr-compromise",
    "since": "2026-04-24T22:10:00Z",
    "until": "unknown",
    "ecosystem": "",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [],
    "packages": [],
    "versions": [],
    "affectedVersions": [],
    "fixedVersions": [],
    "files": [],
    "paths": [],
    "services": [],
    "domains": [
      "ghcr.io",
      "elementary.pth",
      "igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud"
    ],
    "urls": [],
    "ips": [],
    "hashes": [
      "31ecc5939de6d24cf60c50d4ca26cf7a8c322db82a8ce4bd122ebd89cf634255",
      "b3bbfafde1a0db3a4d47e70eb0eb2ca19daef4a19410154a71abee567b35d3d9",
      "fe52712660fef56586d954e50f81ccc7b96ed2809b5e930c7b9d032e7ab03b8d",
      "5cf8f4c3fa0b7e84cb0096c94eb9af941ea632c9acffa002d0db3b3c1d9ef97e"
    ],
    "processPatterns": [],
    "networkPatterns": [],
    "telemetrySelectors": []
  }
}