Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers

Snyk reports multiple active supply‑chain and exploitation incidents: a malicious PyPI release of the elementary-data Python CLI (v0.23.3) was published via a GitHub Actions script‑injection and contains a credential‑stealing backdoor targeting dbt profiles, cloud provider keys and SSH secrets from data engineering environments; separately, two authentication‑bypass vulnerabilities in the Qinglong task scheduler (CVE-2026-3965, CVE-2026-4047) have been exploited in the wild to deploy cryptomining malware. Recommended mitigations include auditing and pinning dependencies, scanning packages for恶