Malicious elementary-data package version 0.23.3 steals developer data and cryptocurrency wallets
The attack exploited a GitHub Actions script injection flaw, allowing the attacker to inject shell code that exposed a GitHub token.
The attack exploited a GitHub Actions script injection flaw, allowing the attacker to inject shell code that exposed a GitHub token.
Source: https://www.scworld.com/brief/malicious-elementary-data-package-version-0-23-3-steals-developer-data-and-cryptocurrency-wallets