Technology

Open source package with 1 million monthly downloads stole user credentials

Source

Ars Technica

Published

Apr 27, 2026

TL;DR

AI Generated

A widely used open source package with 1 million monthly downloads was compromised by threat actors exploiting a vulnerability in the developers’ account workflow, granting access to sensitive information. The malicious package, element-data 0.23.3, was distributed to users, collecting user credentials, API tokens, and more. Users who installed this version are advised to consider their credentials compromised. The attackers gained access through a GitHub action, allowing them to publish the malicious package. The developers swiftly removed the package, rotated credentials, and fixed the vulnerability.

Read Full Article

The Download: a new Christian phone network, and debugging LLMs

A new US phone network for Christians is launching, blocking porn and gender-related content with network-level controls. Goodfire, a San Francisco startup, released Silico, a tool for debugging AI models by allowing users to adjust parameters during training. The National Science Foundation faced mass firings, impacting US science funding and governance. China's AI labs are releasing open-source models, challenging the traditional Silicon Valley approach. Elon Musk admitted using OpenAI models for xAI training, sparking debate on AI ethics and practices.

MIT Technology Review•

6 hours ago

Linux exploit instantly grants administrator access on most distributions since 2017 — cryptography optimization snafu grants root privileges to local users

A recent Linux exploit, CVE-2026-31431, allows local unprivileged users to gain root access instantly on most Linux distributions since 2017. The exploit affects popular distros like Ubuntu, RHEL, Suse, and Amazon Linux, as well as Windows' WSL2. The vulnerability, discovered by Xint Code researchers, involves a cryptography optimization flaw that grants administrator privileges through a devious attack on the AF_ALG socket. While a patch has been released, some distributions may still be vulnerable, requiring mitigation methods like disabling AF_ALG sockets. The exploit occurs in memory without leaving detectable traces on disk, making it challenging to detect with security software.

Tom's Hardware•

8 hours ago

The most severe Linux threat to surface in years catches the world flat-footed

A critical Linux vulnerability, named CopyFail (CVE-2026-31431), has been disclosed by security researchers, allowing unprivileged users to gain root access across various Linux distributions. The exploit code, released by Theori, works universally without modification, posing a significant threat to data centers and personal devices. While the Linux kernel security team patched the vulnerability in several versions, many distributions had not yet implemented the fixes at the time of the exploit's release. This flaw enables attackers to execute malicious activities like hacking multi-tenant systems and creating backdoors, emphasizing the severity of the issue.

Ars Technica•

22 hours ago

Crucial Taiwan undersea cable severed by old shipwreck — backup microwave communications activated to keep population connected

A shipwreck off Dongyin island in Taiwan has severed the undersea cable connecting it to Beigan Island, prompting the activation of backup microwave communications to maintain connectivity for the 1,500 residents. The Matsu Islands' strategic location near mainland China and the Taiwan Strait makes them crucial for Taiwan's military presence. While this incident was due to natural causes, it underscores Taiwan's vulnerability in its global connections. Recent suspicions of deliberate undersea cable damage by Chinese ships have led Taiwan to increase defensive measures and penalties for sabotage attempts. Despite wireless backups, physical undersea cables remain essential for reliable and high-bandwidth internet connections.