Embedded Malicious Code Affecting elementary-data package, versions [0.23.3]
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-ELEMENTARYDATA-16316110
- published28 Apr 2026
- disclosed26 Apr 2026
- creditcrisperik
Introduced: 26 Apr 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the elementary-data package.
Overview
elementary-data is a Data monitoring and lineage
Affected versions of this package are vulnerable to Embedded Malicious Code that is a credential stealer designed to exfiltrate sensitive data from the environment where the CLI is installed or executed. Specifically, the code:
Harvests Secrets: It searches for and collects dbt profiles, data warehouse credentials (e.g., Snowflake, BigQuery), cloud provider keys (AWS, GCP, Azure), API tokens, and SSH keys.
Steals Environment Variables: It scrapes
.envfiles and active environment variables for secrets.Exfiltrates Data: The gathered credentials are sent to an externally hosted command-and-control (C2) server controlled by the attacker.
Note: Elementary Cloud and the Elementary dbt package were not affected, and no other versions of the CLI were affected.