The open-source package elementary-data, with over a million downloads per month, has been compromised. Attackers exploited a vulnerability in a GitHub ...

This was not a case of stolen credentials, but rather of vulnerability exploitation.