The ctx PyPI Package Hijack

What happened

An attacker took control of the ctx package on PyPI. Sonatype reports that the compromise was discovered on 24 May 2022, and that version 0.1.2 was replaced on the registry on 21 May 2022. The GitHub advisory gives the compromise period as 14 to 24 May 2022.

The GitHub advisory says the bad code collected os.environ.items() when a Ctx object was created. It encoded the result in base64 and sent it to a Heroku application endpoint. Environment variables often hold cloud keys, passwords and API tokens.

Sonatype also reports a PHP library, phpass, that carried the same payload. The sources I fetched do not explain how the attacker gained control of the packages.

Affected versions

The GitHub advisory marks ctx versions up to 0.1.4 as vulnerable and lists no patched version. Sonatype names these versions.

• 0.1.2: the clean 2014 release, later replaced with malicious code
• 0.2.2: malicious
• 0.2.6: malicious

The package was removed from PyPI. Because the advisory lists no patched release, stop depending on ctx unless you have verified the source.

Indicators of compromise

• Outbound traffic to anti-theft-web.herokuapp.com, path /hacked/
• An installed ctx package from 14 to 24 May 2022
• In the package source, code that reads environment variables and posts them to a URL

How to check

Check whether ctx is installed.

pip show ctx

If it is present, search the installed files for the exfiltration host. The command does not import the package.

pip show -f ctx | head -20; grep -rn "herokuapp" "$(pip show ctx | awk '/^Location/{print $2}')/ctx"

Search your lockfiles for the package.

grep -rniE "^ctx(==|$)" . --include=requirements*.txt --include=*.lock

What to do now

1. Uninstall ctx and remove it from your requirements files.
2. If you installed it between 14 and 24 May 2022, rotate every password, API key and cloud credential that was in the environment.
3. Audit your cloud accounts for use of those credentials.
4. Check your PHP projects for the phpass library from the affected fork.
5. Pin dependencies with hashes, so a replaced release fails to install.

Vigilance compares the version you trust with a new one and reports the file that gained a new capability. The ctx module gained environment reading and an outbound post. See all attacks.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 9

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

CHANGED    setup.py
           It now downloads from the internet and reads saved passwords and access keys. It did not before.

Sources

1. github.com/advisories/GHSA-4g82-3jcr-q52w
2. sonatype.com/blog/pypi-package-ctx-compromised-are-you-at-risk