An open-source package named elementData, which has one million monthly downloads, was compromised. Threat actors exploited a vulnerability in the developer's account workflow to gain access to signing keys and sensitive information. This allowed them to push a malicious version of the package, which was used to steal user credentials. AI
Summary written by gemini-2.5-flash-lite from 1 source. How we write summaries →
IMPACT Compromise of ML tooling could impact data integrity and system security for operators.
RANK_REASON Security vulnerability in an open-source package used for machine learning systems.