Elementary Data Data Breach April 2026: PyPI Supply Chain Attack Targets Developer Secrets

What Is the Elementary Data Data Breach?

The Elementary Data data breach is a confirmed software supply chain incident that came to light in late April 2026. Threat actors successfully compromised the elementary-data package on the Python Package Index (PyPI) — one of the most widely used package repositories in the world — and used it to deliver a sophisticated infostealer to unsuspecting developers and organisations. With over 1.1 million downloads every month, this single poisoned release had the potential to affect an enormous number of engineering teams and the enterprises they work for.

What makes this breach especially significant for risk professionals is not just its scale, but how it happened: attackers bypassed the software supply chain entirely from the outside, exploiting the project’s own development infrastructure. Here’s what happened, how it worked, and what you should do right now.

What Happened

In April 2026, security researchers and community members discovered that version 0.23.3 of the elementary-data package had been tampered with. The malicious version appeared on PyPI as a legitimate release — indistinguishable at a glance from the trusted builds that data engineers had been installing for years. The package also poisoned associated Docker images on the GitHub Container Registry (GHCR), widening the potential exposure.

According to community members who first flagged the anomaly, roughly six hours elapsed between the publication of the malicious version and the initial public alert. Total time from the initial intrusion to full public disclosure was approximately 18 hours — a remarkably fast response that nonetheless left a meaningful window of exposure for anyone who updated their dependencies during that period.

The affected version is 0.23.3 only. Users on versions 0.23.2 and 0.23.4 (the clean patched release) were not impacted.

How It Happened: The Attack Vector

This was not a traditional breach involving stolen credentials or a brute-force login. Instead, attackers exploited a GitHub Actions CI/CD pipeline vulnerability — a technique that is growing in frequency as threat actors increasingly target developer toolchains rather than production systems directly.

Here is how the attack unfolded:

1. A newly created GitHub account submitted a pull request comment on the elementary-data repository containing a carefully crafted shell script.
2. The project’s GitHub Actions workflow was configured to trigger on pull request comments — a common but dangerous configuration that grants external contributors the ability to invoke automated pipelines.
3. The injected code executed within the GitHub Actions runner environment, which had access to a temporary GITHUB_TOKEN.
4. That token carried sufficient permissions to forge a verified release commit and publish a new package version directly to PyPI.
5. The malicious release was published as version 0.23.3 and simultaneously used to update Docker images on GHCR.

This is what security researchers refer to as a CI/CD pipeline injection attack. The NIST Secure Software Development Framework (SSDF) specifically addresses the need to harden build pipelines against exactly this type of exploitation, recommending that organisations use minimal-privilege tokens, pin Actions to specific commits, and restrict which events can trigger sensitive workflows.

What Was the Damage

The malicious payload embedded in version 0.23.3 was a three-stage infostealer designed to activate immediately upon package installation — before the developer had even run a single line of their own code. Its targets were carefully chosen to maximise financial and operational impact:

• Cloud access tokens — AWS, Google Cloud Platform, and Microsoft Azure credentials stored in environment variables or local configuration files
• SSH private keys — allowing persistent remote access to servers and repositories
• Git credentials — enabling further supply chain manipulation if an attacker gained commit access to other repositories
• Kubernetes service account tokens — granting access to container orchestration environments
• Docker configurations — including registry credentials
• Cryptocurrency wallets — Bitcoin, Ethereum, and other wallet files stored on developer machines

Any developer who ran pip install elementary-data and pulled version 0.23.3 would have had all accessible secrets on their machine silently exfiltrated. For enterprises where developers share cloud environments or where CI/CD runners have broad permissions, the downstream blast radius extends well beyond the individual.

Research shows that software supply chain attacks have increased significantly in recent years, with open-source package repositories representing one of the highest-risk vectors for enterprise environments, according to guidance published by CISA on defending CI/CD environments.

Current Situation

The Elementary Data maintainers acted swiftly once alerted by the community. The malicious version 0.23.3 was removed from PyPI and a clean build — version 0.23.4 — was released to replace it. Docker images on GHCR were similarly remediated. The GitHub Actions workflow responsible for the vulnerability was patched to prevent pull request comment triggers from executing in a privileged context.

At the time of writing, no regulatory body has formally announced an investigation, though organisations in regulated sectors that may have been affected — particularly those in financial services or healthcare — should assess their notification obligations under applicable frameworks such as GDPR, DORA, or relevant state breach notification laws.

Affected users are strongly advised to:

• Immediately rotate all cloud access tokens, SSH keys, and any other credentials that may have been present on affected machines
• Audit cloud access logs for anomalous API calls in the period after the malicious package was available
• Review Kubernetes and Docker configurations for signs of unauthorised access
• Upgrade to elementary-data version 0.23.4 or the latest stable release

TPRM Takeaway: What This Means for Third-Party Risk Managers

The Elementary Data incident is a textbook example of a risk that standard vendor due diligence processes were never designed to catch. Most organisations assess vendors based on their security policies, certifications, and questionnaire responses — none of which would have surfaced the fact that a single misconfigured GitHub Actions workflow could hand an attacker the keys to a vendor’s entire software distribution chain. For third-party risk managers, the lesson is direct: you must now extend your vendor risk assessments to include software supply chain controls. This means asking vendors to provide a Software Bill of Materials (SBOM) for any software deliverable, requiring evidence that CI/CD pipelines enforce least-privilege token policies, and including open-source dependency management practices in your vendor security questionnaires. You should also consider mapping which of your vendors use Python packages — particularly in data engineering and analytics contexts — and implementing internal controls to scan and verify package integrity before deployment. Explore our guide on supply chain attack prevention for TPRM teams and cybersecurity vendor due diligence to strengthen your programme today.

Frequently Asked Questions

What is the Elementary Data data breach?

The Elementary Data breach was a software supply chain attack in April 2026 where threat actors compromised the elementary-data PyPI package, injecting an infostealer into version 0.23.3. It affected users who downloaded that version, putting cloud credentials and developer secrets at serious risk of exfiltration.

How did attackers compromise the Elementary Data PyPI package?

Attackers exploited a misconfigured GitHub Actions workflow that triggered on pull request comments. By injecting malicious shell code into a comment on an open pull request, they obtained a temporary GitHub token with enough privileges to publish a poisoned package version to PyPI without authorisation from the project maintainers.

What data was stolen in the Elementary Data breach?

The infostealer targeted cloud access tokens for AWS, Google Cloud, and Azure; SSH private keys; Git credentials; Kubernetes service account tokens; Docker registry credentials; and cryptocurrency wallet files. Any developer who installed version 0.23.3 was potentially exposed to all of these.

Who was affected by the elementary-data PyPI supply chain attack?

Any developer or organisation that installed elementary-data version 0.23.3 during its brief window of availability was potentially affected. Given the package’s 1.1 million monthly downloads, the potential victim pool spanned thousands of organisations across data engineering, analytics, and software development sectors globally.

What should TPRM professionals do in response to PyPI supply chain attacks?

Risk teams should audit software dependencies across all vendor-developed applications, require vendors to provide SBOMs and evidence of hardened CI/CD pipelines, and implement internal controls to verify open-source package integrity. Cloud credentials on any system that installed the malicious version should be rotated immediately as a precautionary measure.