Open Source · · 10 days

ctx PyPI account stole environment variables

An attacker re-registered the expired maintainer email domain for ctx and reset its PyPI account. Malicious releases exfiltrated environment variables to Heroku.

ctx was a small Python package with an old release history. Its last legitimate release was in 2014, and the maintainer email domain later expired. In May 2022, the attacker registered that domain, recreated the maintainer email address, and used PyPI password recovery to take over the official package account.

The new releases looked like ordinary PyPI updates but carried a short credential theft routine. When a Ctx object was created, the code walked process environment variables, base64-encoded the collected values, and sent them to anti-theft-web.herokuapp.com. AWS keys and CI/CD secrets were the obvious prize.

The compromise mattered because the package name was legitimate. Users did not install a typosquat. They installed ctx from PyPI and received code from the official registry page tied to that project name.

The event was reported alongside the hautelook/phpass repo-jacking incident. Both attacks used abandoned identity to regain control of established package coordinates. PyPI removed ctx, deleted the release files, blocked the name from re-registration without administrator review, and froze the compromised owner account.

Appendix · Affected releases

ctx pypi
0.1.2 sha256 5dc1bc14…20dff3d3 download unavailable
0.2.2 sha256 acf05948…b853d3fb download unavailable
0.2.6 sha256 04b150ce…dcc0fb94 download unavailable
  • Orca and CrowdStrike describe the account takeover as a PyPI password reset enabled by re-registering the expired figlief.com domain.
  • Sonatype observed malicious versions 0.2.2 and 0.2.6 and reported that the PyPI copy of 0.1.2 had also been replaced with malicious code.
  • The SHA-1 values identify the backdoored 0.1.2, 0.2.2 and 0.2.6 source tarballs in version order. The malicious 0.1.2 tarball is distinct from PyPI's retained clean 0.1.2 wheel and source distribution.
  • The archived Python Security report preserves malicious wheel URLs and SHA-256 values for 0.1.2-1, 0.2.2 and 0.2.6, and those wheels are retained under samples/ctx/during. 0.1.2-1 is a PyPI build suffix, not a separate version.
Payloads and stagesno published version
0.1.2-1 sha256 b40297af…125b3bb5 download unavailable

References

  1. Supply Chain Attack: CTX Account Takeover and PHPass Hijack Explainedorca.security
  2. Detecting Poisoned Python Packages: CTX and PHPasscrowdstrike.com
  3. PyPI Package 'ctx' and PHP Library 'phpass' Compromised to Steal Environment Variablessonatype.com
  4. PyPI package ctx and PHP library phpass compromisedthehackernews.com
  5. Attackers compromised PyPI package to steal AWS keyscybersecuritynews.com
  6. ctx Python Library Updated with Extra Features - SANS ISCisc.sans.edu
  7. Account Takeover and Malicious Replacement of ctx Project - Python Securitypython-security.readthedocs.io

Source record: oss/attacks/ctx/meta.yaml