Poisoned Pipeline / Incidents / AS213
ctx PyPI account stole environment variables
Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.
Mapped techniques
- T0172 Runtime backdoor
- T0184 Harvesting sensitive information from files
- T0121 Compromised legitimate artifact
- T0109 Publish malicious artifact
supply-chain campaign
Backdoor/RAT payload documented by the cited sources.
Credential or wallet material targeted.
Published package versions carried the payload.
Named in the tstromberg supplychain-attack-data corpus with first-party references.
Sources
- https://orca.security/resources/blog/python-supply-chain-attack-ctx-phpass/
- https://www.crowdstrike.com/en-us/blog/how-crowdstrike-detects-poisoned-python-packages-ctx-phpass/
- https://www.sonatype.com/blog/pypi-package-ctx-compromised-are-you-at-risk
- https://cybersecuritynews.com/attackers-compromised-pypi-package/
- https://isc.sans.edu/diary/28678
- https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html