Tracking: Incident report
Severity: Supply-chain incident; no CVSS score assigned here
Who is affected
elementary-data 0.23.3 and the corresponding 0.23.3 and latest container images published during the compromise. A mutable latest tag must be checked by image digest and pull time.
How the attack works
The incident analysis describes a CI/CD compromise used to publish malicious artifacts. The payload searched the environment for credentials, including dbt profiles, warehouse access, cloud keys, API tokens, SSH material, and environment secrets.
Installing or running the affected artifact is the important exposure condition. Removing the package stops future execution but does not revoke credentials already stolen.
What to do
- Remove 0.23.3 and affected images. Move to 0.23.4 or another confirmed clean release, using trusted artifacts and reviewed image digests.
- Identify developer machines, scheduled data jobs, and CI runners that installed or ran the malicious release. Preserve package, image, and execution evidence.
- Rebuild affected environments and rotate accessible credentials from a clean system. Review warehouse, cloud, source-control, and CI activity for unauthorized use.
Scope and limits
This is a malicious-release incident, not a vulnerability with a CVE. Exposure depends on the artifact actually used, including container provenance.