GitHub Actions Workflow Flaw Leads to Malicious PyPI Package: Elementary Data Incident Analysis

Introduction

A recent security incident involving the open-source Python CLI tool elementary-data has highlighted the growing risks in CI/CD pipelines. On April 24, attackers exploited a vulnerability in a GitHub Actions workflow to inject malicious code into the package. The compromised version, 0.23.3, was published to PyPI and a tampered Docker image was pushed to the registry. This article details how the attack unfolded, who was affected, and the steps users must take to secure their systems.

The Incident: How Attackers Exploited a GitHub Actions Workflow

The breach originated from a critical flaw in one of Elementary Data's GitHub Actions workflows. The workflow was configured to accept text from pull request comments and pass it directly into a shell command without proper sanitization. This oversight allowed an attacker to execute arbitrary code simply by posting a malicious comment on a PR.

At 22:10 UTC on April 24, the attacker submitted a crafted comment on a pull request. The workflow processed it as a legitimate command, exposing sensitive secrets—including the PyPI publish token and the GITHUB_TOKEN. With these credentials, the attacker created branches and pull requests to stage a release. By 22:20 UTC, the malicious package elementary-data 0.23.3 was live on PyPI. Four minutes later, a compromised Docker image was pushed to the registry.

Scope of the Compromise: Which Users Are Affected?

The impact is limited to users who installed elementary-data 0.23.3 from PyPI or pulled the malicious Docker image during the attack window. Importantly:

• Elementary Cloud remains unaffected.
• The Elementary dbt package is not compromised.
• All other versions of the CLI are safe.

However, for those running 0.23.3, the consequences are serious. The malware had access to the same environment variables, tokens, and resources as the legitimate application, potentially exposing sensitive data.

Immediate Remediation Steps for Affected Users

1. Check Your Installed Version

Run the following command to verify your current version:

pip show elementary-data | grep Version

If it shows 0.23.3, proceed with the removal steps below.

2. Remove the Malicious Version and Install the Clean Version

Uninstall the compromised package and install the patched version immediately:

pip uninstall elementary-data
pip install elementary-data==0.23.4

Also update your requirements.txt or lockfiles to reflect version 0.23.4 to prevent accidental reinstallation of the old version.

3. Look for the Malware's Marker File

The malware leaves a marker file to indicate its presence. Check for the following:

• Linux/macOS: /tmp/.trinny-security-update
• Windows: %TEMP%\.trinny-security-update

If the file exists, the payload executed on that machine. Its presence means the attacker had remote code execution capabilities in that environment.

4. Rotate All Credentials if Marker Found

Immediately rotate every credential that the affected environment had access to—API keys, database passwords, cloud provider tokens, etc. Notify your security team to audit activity logs for any unauthorized actions involving those credentials. Consider this a full security incident requiring thorough investigation.

Elementary Data's Response and Future Precautions

Elementary Data acted swiftly after discovering the breach. On April 25, they removed version 0.23.3 from PyPI, GitHub, and the Docker registry. Internally, they decommissioned the vulnerable workflow and audited all remaining GitHub Actions for similar injection flaws. All exposed secrets were regenerated, and the team transitioned to OIDC authentication to reduce reliance on long-lived tokens.

To ensure long-term security, Elementary is collaborating with an Israeli cybersecurity firm to investigate the attack and strengthen their CI/CD defenses. This incident serves as a stark reminder that open-source projects must treat their automation workflows as part of the attack surface.

Conclusion

The exploitation of a GitHub Actions workflow to push malicious code to PyPI is a wake-up call for the developer community. While the immediate damage is contained to version 0.23.3, the attack vector—unsanitized input in CI/CD pipelines—remains a common vulnerability. Users should apply the remediation steps above and consider adopting the credential rotation procedures as part of their incident response plan. For maintainers, it's critical to audit workflows for shell injection risks and implement least-privilege token policies.