Compromised open source package pushed malicious Elementary CLI release to developers

Threat actors gained access to sensitive developer data and cryptocurrency wallets after a popular open source software tool was compromised.

Developers behind the Elementary Python command line interface (CLI) tool revealed a recent release (version 0.23.3) included malicious code.

Attackers exploited a script injection vulnerability in the open source project’s GitHub Actions workflow to push the malicious update to users.

This malicious version was subsequently published on PyPI, as well as a Docker image pushed to the project’s registry.

In a blog post detailing the incident, developers said the malicious version was removed roughly 12 hours later. Elementary Cloud, the Elementary dbt package, and other CLI versions weren’t affected.

A replacement version (0.23.4) has also been released, however developers warned those who downloaded the malicious version are still at high risk.

What happened with the Elementary CLI attack?

Analysis of the incident by researchers at StepSecurity found attackers exploited a script injection vulnerability in the project’s GitHub Actions workflow.

Thereafter, they used the workflow’s GITHUB_TOKEN to “forge a signed release commit” and push the malicious version through a legitimate release pipeline.

According to StepSecurity, a .pth file was baked into the release, which upon startup allowed the threat actor(s) to harvest an array of sensitive data, including:

• SSH keys
• Cloud credentials, including AWS, GCP, and Azure
• CI secrets
• Container orchestration data
• System data (passwords, logs, shell history)
• Crypto wallet files (including Bitcoin, Litecoin, Monero, and Ripple)

What developers need to know

Project maintainers warned that users who installed the malicious version should “assume that any credentials accessible to the environment where it ran may have been exposed”.

Developers outlined a series of steps to take for those affected, including:

• Check your installed version (pip show elementary-data | grep Version)
• If the version is 0.23.3, uninstall it and replace it with the safe version
• Delete your cache files to avoid any artifacts
• Check for the malware’s marker file on any machine where the CLI may have run: If this file is present, the payload executed on that machine.

Developers are also advised to rotate credentials that were accessible from the environment where 0.23.3 ran. This includes dbt profiles, cloud provider keys, API tokens, SSH keys, and contents of .env files.

“CI/CD runners are especially exposed because they typically have broad sets of secrets mounted at runtime,” the blog post noted.

In the wake of the incident, project maintainers noted they have “hardened” open source release flows and permissions.

The vulnerable GitHub Action workflow has also been removed, while an audit of other GitHub Actions workflows across the organisation has been conducted to identify the same type of script injection flaw.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.