Open source package with 1 million monthly downloads stole user credentials

If you're one of millions using element-data, it's time to check for compromise.

See full article...

 

[ferdnyc]

The subtitle and first instance in the story call this "element-data" but the link goes to "elementary-data". I suspect the distinction is important, but to be fair, I know nothing about this.

The distinction is pretty important if you actually want to correctly identify the package in question, which is called elementary-data. I don't know where "element-data" came from, but it would be good if Ars fixed that.