Popular open-source tool with 1M downloads was stealing passwords
A widely used open-source package called element-data has been stealing user credentials. If you've used it, check your accounts immediately. This highlights the risks of unvetted software.