---
id: "INC-pypi-s8vm6pwr46c2"
kind: "incident"
aliases: []
title: "PyPI: Malicious takeover of ctx project on PyPI."
severity: "low"
cvss: null
epss: null
exploited: false
status: "resolved"
category: "vendor"
products: [{"name": "PyPI", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["incident", "pypi", "python", "registry", "security", "self-hosted", "vendor"]
not_affected_if: ["no-ctx-dependency"]
published_at: "2022-05-24T10:00:00+00:00"
first_seen_at: "2026-10-23T19:12:22+00:00"
updated_at: "2026-10-25T05:41:52+00:00"
sources: [{"source": "statuspage", "url": "https://stspg.io/pn714s4b42d3", "first_seen_at": "2026-10-23T19:12:22+00:00"}]
---

# PyPI: Malicious takeover of ctx project on PyPI.

The ctx project on PyPI was hijacked after its maintainer's email domain expired and was re-registered by someone else, who reset the account password. The attacker deleted the original releases and uploaded malicious copies that would be installed by anyone pulling ctx from PyPI.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PyPI affected ? fixed ?

## How to check

- Run `pip show ctx` and `pip index versions ctx` to see which version is installed and what exists on PyPI
- Check requirements files and lockfiles for `ctx` and review any install from May 2022 onward
- Inspect an installed ctx package for unexpected code, for example in its `setup.py` or `__init__.py`

## Fix

- Remove any malicious ctx copy and reinstall from a known-good release, if one exists in your sources; the sources do not name a safe version
- Rotate any credentials or secrets present on machines that installed the malicious ctx package
- Pin dependencies to hashes so a replaced release cannot install silently

## Timeline

- 2026-10-23T19:12:22+00:00 statuspage https://stspg.io/pn714s4b42d3

## From the sources

Takeover of the ctx project was reported on multiple channels overnight and was mitigated as of 6:07 AM Eastern.

We confirmed via investigation that this compromise was of a single user account due to re-registration over an expired domain. The domain that hosted the users email address was re-registered 2022-05-14T18:40:05Z and a password reset completed successfully for the user at 2022-05-14T18:52:40Z. Original releases were then deleted and malicious copies uploaded.

PyPI itself was not directly compromised.

Read the full incident report at [https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html](https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_