GHSA-4g82-3jcr-q52w
Malware in ctx
Details
The `ctx` hosted project on [PyPI](https://pypi.org/project/ctx/) was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of `os.environ.items()` when instantiating `Ctx` objects. The captured environment variables were sent as a base64 encoded query parameter to a heroku application running at `https://anti-theft-web.herokuapp.com`.
If you installed the package between May 14, 2022 and May 24, 2022, and your environment variables contain sensitive data like passwords and API keys (like `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`), we advise you to rotate your passwords and keys, then perform an audit to determine if they were exploited.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for ctx (pip). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/figlief/ctx[PACKAGE]
- https://isc.sans.edu/forums/diary/ctx+Python+Library+Updated+with+Extra+Features/28678[WEB]
- https://portswigger.net/daily-swig/malicious-python-library-ctx-removed-from-pypi-repo[WEB]
- https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html[WEB]