PyPI “ctx” package compromised with malicious AWS credential stealer

A malicious version of the Python package ctx appeared on PyPI on May 14 2022, inserting code that harvests AWS credentials and other environment variables and ships them to a attacker‑controlled server [2].

The attack hinged on the original maintainer’s domain expiring; the threat actor registered the domain on the same day and used the new email address to reset the maintainer’s password and push three rogue releases (0.1.2, 0.2.2, 0.2.6) [2]. The injected payload captures the AWS access key ID, secret key, and computer name, or in another variant, all environment variables, encoding them in Base64 before sending them to a Heroku URL [1].

Both the SANS Internet Storm Center and Sonatype traced the incident to a broader pattern of supply‑chain hijacks, noting that the “ctx” package had not been updated since December 2014 before the malicious upload, and that similar tactics have been used to hijack thousands of NPM packages via expired maintainer domains [1]. An Istanbul‑based researcher later claimed responsibility, saying he bought the expired domain for $5 and used the password‑reset flow to gain control, framing the act as a demonstration of the risk to over ten million users [1].

The compromised versions have since been removed from PyPI, but the episode underscores how stale packages and neglected domain registrations can become entry points for attackers. Developers who installed any “ctx” release after May 14 should verify they are not running the malicious code and consider regenerating any AWS keys that may have been exposed.

The incident raises a lingering question: as open‑source ecosystems continue to grow, how can maintainers and repository operators better safeguard abandoned packages and domains to prevent similar supply‑chain breaches?