GMS-2022-1726: Embedded Malicious Code in ctx

June 2, 2022

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.

References

github.com/advisories/GHSA-67r3-h899-9w95
github.com/pypa/advisory-database/tree/main/vulns/ctx/PYSEC-2022-199.yaml
python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html

Detect and mitigate GMS-2022-1726 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →