A supply chain attack compromised the elementary-data Python package, with malicious version 0.23.3 published to PyPI through GitHub Actions script injection. The attack also pushed compromised container images to GitHub Container Registry. The malicious package was still listed as the latest release at the time of reporting, affecting both PyPI distribution and container deployments. This represents an active supply chain compromise targeting Python developers and containerized environments.