Open source package with 1 million monthly downloads stole user credentials
2026-04-28T20:51:53Z•e8efded12a6f5d10f81941046406aa21281a202d0fc7b84f88276210525239e4
AI-securityASP.NETGPU-exploitIoTIranLinuxNvidiaQ-DayRowhammerRussiaauthentication-bypasscredential-theftcritical-infrastructuredata-exfiltrationmacOSnation-statenpm-packageopen-sourcepost-quantum-cryptographyprivilege-escalationquantum-threatransomwarerouter-compromisesupply-chainvulnerability-discovery
What happened
A wave of high-impact security issues reported across April 2026: a widely used open-source package (element-data, ~1M monthly downloads) was found exfiltrating user credentials (supply-chain compromise); thousands of end‑of‑life consumer routers were hacked by Russia’s military to steal credentials; Iran‑linked actors disrupted US critical infrastructure; a Microsoft emergency patch addresses an ASP.NET authentication failure affecting macOS and Linux; multiple new Rowhammer variants (GDDRHammer, GeForge, GPUBreach) allow full system compromise of machines with Nvidia GPUs; an AI system (Anth
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- arstechnica_security
- Record identifier
- e8efded12a6f5d10f81941046406aa21281a202d0fc7b84f88276210525239e4
- Enrichment time
- 2026-04-28T20:51:53Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.