Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers

Multiple Snyk posts describe active supply-chain and remote-exploit incidents. A malicious release of the elementary-data Python CLI (v0.23.3) was published after attackers exploited a GitHub Actions script-injection vulnerability; the package included a credential-stealing backdoor that targeted dbt profiles, cloud provider keys, and SSH secrets from data engineering environments. Separately, Qinglong task scheduler authentication-bypass RCEs (CVE-2026-3965, CVE-2026-4047) were exploited in the wild to deploy cryptomining malware. Operators should treat these as high-priority: revoke and roll