GitHub Advisoryadvisory · PyPI

GHSA-67r3-h899-9w95 Embedded Malicious Code in ctx

CRITICAL Published 2022-06-02 Modified 2022-06-02 Official page ↗
Ecosystem
PyPI
Packages
ctx
Severity
Critical
Reviewed
2022-06-02

Affected packages

• PyPI ctx: >= 0.1.2-1 (no fix yet)

Description

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.

References