Element-data, an open source package downloaded 1 million times monthly, was found stealing user credentials. Users of the library should immediately check for signs of compromise.
Security researchers discovered that element-data, a widely-used open source package, contained malicious code designed to harvest user credentials. The package, which maintains approximately 1 million monthly downloads, had been compromised without the knowledge of its users or maintainers.
■ The Breach
The malicious code embedded in element-data was designed to exfiltrate sensitive user authentication data. The exact scope of affected versions and the duration of the compromise remain under investigation.
■ What You Should Do
Users of element-data should take immediate action:
- Audit your systems: Check for unauthorized access or activity on accounts that may have used this package
- Rotate credentials: Change passwords and regenerate API keys for any services accessed by applications using element-data
- Update immediately: Remove the compromised package and update to a patched version when available
- Review logs: Examine application logs for suspicious activity dating back to when the package was first installed
■ Impact
The large download volume means the potential impact is significant. Any application or service that incorporated element-data could have been affected. Organizations using this package in production environments face particular risk.
■ Next Steps
Maintainers have been notified and are working to remediate the issue. Additional details about the compromise timeline and affected versions are expected as the investigation progresses. Users should monitor official package repositories and security advisories for updates.
This incident underscores the risks inherent in open source software supply chains, where popular packages can reach millions of users before security issues are detected.
Two recently patched vulnerabilities in PaperCut NG and MF print management software are being actively exploited in data theft campaigns. The zero-days were patched last week after initial exploitation was discovered.
Inexpensive GPS jamming devices are proliferating globally, disrupting navigation systems across civilian infrastructure. The low cost and easy availability of these tools are creating widespread interference zones.
Devices promising free movies are recruiting home internet connections into proxy networks without users' knowledge. The trade-off: your bandwidth and privacy.
QubesOS released a security update addressing a critical vulnerability that allows arbitrary code execution through an error reporting backchannel in the copy-to-VM function. The flaw affects multiple Qubes versions.