# Malicious takeover of ctx project on PyPI.

- Provider: [PyPI](https://down.guide/pypi)
- Level: confirmed
- Impact: Operational
- lasted 0m
- started 2022-05-24 17:32 UTC
- id: DWN-d34d634587
- Official page: https://stspg.io/pn714s4b42d3

## Updates from PyPI
### 2022-05-24 10:00 UTC: resolved
This incident has been resolved.

### 2022-05-24 17:33 UTC: postmortem
Takeover of the ctx project was reported on multiple channels overnight and was mitigated as of 6:07 AM Eastern.
We confirmed via investigation that this compromise was of a single user account due to re-registration over an expired domain. The domain that hosted the users email address was re-registered 2022-05-14T18:40:05Z and a password reset completed successfully for the user at 2022-05-14T18:52:40Z. Original releases were then deleted and malicious copies uploaded.
PyPI itself was not directly compromised.
Read the full incident report at https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html.

From the builder: does your app depend on PyPI? [Sazabi](https://www.sazabi.com/?utm_source=down-guide&utm_medium=markdown&utm_content=pypi) detects problems in your own logs without hand-written monitors, and you can ask it in plain language which errors mention PyPI.

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by [Sazabi](https://www.sazabi.com/?utm_source=down-guide&utm_medium=markdown&utm_content=DWN-d34d634587), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.