Open source package with 1M monthly downloads stole user credentials

The open source package known as element-data was caught stealing user credentials while quietly racking up over one million monthly downloads — and it's a textbook example of why blind trust in the npm ecosystem is a security liability. This isn't a niche edge case; it's a supply chain attack that touched a staggering number of developers and production environments.

How we got here: the npm trust problem

The open source package ecosystem, particularly npm, has scaled to a point where auditing every dependency in a modern project is essentially impossible. Developers rely on download counts, GitHub stars, and package age as proxies for trustworthiness — metrics that, as this case proves, mean nothing when it comes to actual security. Supply chain attacks have been escalating since the SolarWinds breach in 2020, and the open source registry is now one of the most attractive targets for threat actors.

What element-data actually did

element-data, an npm package with over one million monthly downloads, was found to contain malicious code designed to exfiltrate sensitive user data — including credentials, authentication tokens, and potentially session data. It's not yet fully confirmed whether the package was malicious from the start or whether a maintainer account takeover was used to inject the malicious code after the fact — a method that's becoming increasingly common and harder to detect. What is confirmed: millions of development and production environments were exposed for the duration of the malware's active period, with no warning signs visible to the average developer or end user.

What this really means for open source security

This isn't an anomaly — it's a symptom of a structural flaw. The implicit trust model that underpins npm, where anyone can publish and anyone can install with a single command, is convenient and fundamentally broken at the same time. High download numbers create a false sense of legitimacy, and attackers have figured this out. Most development teams simply don't have the bandwidth to deeply audit every package and transitive dependency in their dependency tree, which makes this attack vector highly scalable for bad actors.

What needs to happen next

If element-data is anywhere in your projects, the immediate steps are clear:

• Remove the package and rotate every credential that could have been exposed.
• Check outbound network logs for suspicious connections during the exposure window.
• Run a full dependency audit using tools like npm audit, Socket.dev, or Snyk.

At the industry level, this incident will add more pressure on package registries to implement meaningful controls: mandatory maintainer verification, automated malicious code scanning, and cryptographic signing of packages. The OpenSSF (Open Source Security Foundation) has been pushing for exactly this, but adoption has been slow relative to how fast the threat landscape moves. GitHub's package security features are improving, but voluntary adoption isn't enough when the stakes are this high.

The uncomfortable question isn't whether this will happen again — it's how many packages with similar malicious code are sitting in npm right now, waiting to be discovered.

Source: Ars Technica