Trusted Data Tool Poisoned, Then Its Container Image Too
A package release can now poison both developer installs and deployed containers. The standard response is to remove the bad PyPI version, but that misses the bigger problem: the same release pipeline also pushed a compromised Docker image, so CI and registry consumers inherit the same backdoor.
The malicious elementary-data 0.23.3 release was pushed to PyPI and also built into the project’s GitHub Container Registry image. The package has more than 1.1 million monthly downloads, and maintainers have already published 0.23.4, but anyone who pulled 0.23.3 or :latest remains exposed.
This turns a normal dependency update into a supply-chain compromise that can reach both laptops and production environments. The risk persists anywhere the poisoned package or image was already mirrored, cached, or deployed.