Live › incident › INC-pypi-s8vm6pwr46c2
Go to dashboardThe ctx project on PyPI was hijacked after its maintainer's email domain expired and was re-registered by someone else, who reset the account password. The attacker deleted the original releases and uploaded malicious copies that would be installed by anyone pulling ctx from PyPI.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:12 UTC. All times on this page are UTC.
Any team that installed the ctx package from PyPI during the window when the malicious copies were live is exposed, because the installed code is what runs. PyPI itself was not compromised, so the risk comes from the package contents rather than the registry. Teams that never pulled ctx from PyPI can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PyPI | vendor | – | – |
pip show ctx and pip index versions ctx to see which version is installed and what exists on PyPIctx and review any install from May 2022 onwardsetup.py or __init__.pyEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Takeover of the ctx project was reported on multiple channels overnight and was mitigated as of 6:07 AM Eastern.
We confirmed via investigation that this compromise was of a single user account due to re-registration over an expired domain. The domain that hosted the users email address was re-registered 2022-05-14T18:40:05Z and a password reset completed successfully for the user at 2022-05-14T18:52:40Z. Original releases were then deleted and malicious copies uploaded.
PyPI itself was not directly compromised.
Read the full incident report at https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html.
This page as .md · .json · in your agent: get_signal("INC-pypi-s8vm6pwr46c2")