Malicious takeover of ctx project on PyPI.

What to do

• Check whether your product depends on PyPI. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2022-05-24 17:32 UTC and 2022-05-24 10:00 UTC may need a replay.

• Subscribe to PyPI's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=pypi works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from PyPI 2

1. resolvedMay 24, 2022, 10:00 AM UTC

   This incident has been resolved.

   provider

2. postmortemMay 24, 2022, 5:33 PM UTC

   Takeover of the ctx project was reported on multiple channels overnight and was mitigated as of 6:07 AM Eastern. We confirmed via investigation that this compromise was of a single user account due to re-registration over an expired domain. The domain that hosted the users email address was re-registered 2022-05-14T18:40:05Z and a password reset completed successfully for the user at 2022-05-14T18:52:40Z. Original releases were then deleted and malicious copies uploaded. PyPI itself was not directly compromised. Read the full incident report at [https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html](https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html).

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.