Menu

Post image 1
Post image 2
Post image 3
1 / 3
0

Open source package with 1 million monthly downloads stole user credentials

Ars Technica - All content·Dan Goodin·about 1 month ago
#pEwSOvFe
Reading 0:00
15s threshold

The developers are urging all developers who installed version 0.23.3 to take the following steps immediately: 1. Check your installed version: pip show elementary-data | grep Version 2. If the version is 0.23.3, uninstall it and replace it with the safe version: pip uninstall elementary-data pip install elementary-data==0.23.4 In your requirements and lockfiles, pin explicitly to elementary-data==0.23.4. 3. Delete your cache files to avoid any artifacts. 4. Check for the malware’s marker file on any machine where the CLI may have run: If this file is present, the payload executed on that machine. macOS / Linux: /tmp/.trinny-security-update Windows: %TEMP%\\.trinny-security-update 5. Rotate any credentials that were accessible from the environment where 0.23.3 ran – dbt profiles, warehouse credentials, cloud provider keys, API tokens, SSH keys, and the contents of any .env files. CI/CD runners are especially exposed because they typically have broad sets of secrets mounted at runtime. 6.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Read More