elementary-data PyPI and GHCR releases forged

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0121 Compromised legitimate artifact
T0109 Publish malicious artifact

supply-chain campaign

T0121 · Resource Development · Compromised legitimate artifact

Published package versions carried the payload.

T0109 · Resource Development · Publish malicious artifact

Named in the tstromberg supplychain-attack-data corpus with first-party references.

Sources

https://www.elementary-data.com/post/security-incident-report-malicious-release-of-elementary-oss-python-cli-v0-23-3
https://www.stepsecurity.io/blog/elementary-data-compromised-on-pypi-and-ghcr-forged-release-pushed-via-github-actions-script-injection
https://snyk.io/blog/malicious-release-of-elementary-data-pypi-package-steals-cloud-credentials-from-data-engineers/
https://cybersecuritynews.com/pypi-package-hacked-with-malware/