Researchers discover that a popular Python library “ctx” and PHP package “phpass” have been compromised to steal developers' AWS keys and credentials

PyPI module ‘ctx’ that gets downloaded over 20,000 times a week has been compromised in a software supply chain attack …

BleepingComputer 2022-05-25 Ax Sharma

Context & Ripple Effects

The incident extends a package-repository abuse pattern seen in counterfeit PyPI packages that installed cryptomining code, but redirects the payload toward developers’ cloud credentials. Later PyPI evidence of credentials exposed in submitted projects underscores why a compromised development dependency can expose more than the machine running it.

The affected ctx package’s reported download volume makes dependency trust the immediate issue: code obtained through a routine package install can become a channel for AWS credential theft.

First-order effects

Developers and teams using ctx or phpass must treat AWS keys and credentials available to those packages as exposed, creating an immediate credential-revocation and replacement task.
Python and PHP users relying on the compromised packages face a direct integrity problem in dependencies that were expected to be routine development components.

Second-order effects

Organizations using PyPI or PHP package dependencies will have stronger reason to audit transitive packages and limit the credentials available in development environments.
AWS customers are affected indirectly because stolen developer credentials can turn a package compromise into unauthorized access to cloud resources tied to those keys.

Third-order effects

The later campaign affecting npm packages and the PyPI package Lightning suggests package compromise is becoming a cross-registry credential-access vector rather than a problem confined to one language ecosystem.
If maintainers and registries do not improve account and release protections, software supply-chain security will increasingly hinge on containing credentials and verifying dependency provenance.

The trend: Open-source package ecosystems are becoming a recurring access layer for attacks that target the cloud credentials held by developers and maintainers.

Discussion

@s0md3v @s0md3v on x
🚨 ALERT 🚨 Python's ctx library and a fork of PHP's phpass have been compromised. 3 million users combined. The malicious code sends all the environment variables to a heroku app, likely to mine AWS credentials.
@theprincessxena @theprincessxena on x
Be warned: Python's ctx library and the hautelook fork of phpass have been compromised. If you use those libraries, declare an incident, be prepared to rotate all credentials stored in environment variables and inform relevant data protection authorities about a possible breach. …
@sanjaykatkar Sanjay Katkar on x
Yet another malicious Python package has been spotted in the PyPI registry performing supply chain attacks to drop Cobalt Strike beacons and backdoors on Windows, Linux, and macOS systems.> https://www.bleepingcomputer.com/ ... #Linux #CyberSecurity #infosec
@tomlawrencetech Tom on x
PyPI module ‘ctx’ that gets downloaded over 20,000 times a week has been compromised in a software supply chain attack with malicious versions stealing the developer's environment variables. https://www.bleepingcomputer.com/ ...
@gossithedog Kevin Beaumont on x
Interesting supply chain hack unfolding via Python code library and PHP. Specifically posts AWS secret keys to a remote server. https://twitter.com/...

Chronicles