{"id":"GHSA-67r3-h899-9w95","aliases":[],"status":"published","title":"Embedded Malicious Code in ctx","description":"The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2022-06-02T15:46:06Z","modified":"2023-01-11T05:07:17Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ctx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.2-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ctx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.2-1"}]}]}],"references":[{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ctx/PYSEC-2022-199.yaml","tags":["web"]},{"url":"https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-67r3-h899-9w95"}],"sources":{"ghsa":[{"id":"GHSA-67r3-h899-9w95","title":"Embedded Malicious Code in ctx","description":"The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.","status":"published","published":"2022-06-02T15:46:06Z","modified":"2023-01-11T05:07:17Z","updated_at":"2026-11-02T14:36:13.23016Z"}],"osv":[{"id":"GHSA-67r3-h899-9w95","title":"Embedded Malicious Code in ctx","description":"The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.","status":"published","published":"2022-06-02T15:46:06Z","modified":"2022-06-02T15:46:06Z","updated_at":"2026-11-02T15:46:39.266402Z"}]}}