Popular Python and PHP LIbraries Hijacked to Steal AWS Keys

A software supply chain assault has compromised the PyPI module ‘ctx,’ which is downloaded over 20,000 times per week, with malicious versions collecting the developer’s environment variables. The threat actor even replaced older, secure versions of ‘ctx’ with code that gathers secrets like Amazon AWS keys and credentials by exfiltrating the developer’s environment variables. 

In addition, versions of a ‘phpass’ fork released to the PHP/Composer package repository Packagist had been modified in a similar way to steal secrets. Over the course of its existence, the PHPass framework has had over 2.5 million downloads from the Packagist repository—though malicious variants are thought to have received significantly fewer downloads. 

The widely used PyPI package ‘ctx’ was hacked earlier this month, with newer released versions leaking environment variables to an external server. ‘ctx’ is a small Python module that allows programmers to manipulate dictionary (‘dict’) objects in various ways. Despite its popularity, the package’s developer had not touched it since 2014, according to BleepingComputer. Newer versions, which were released between May 15th and this week, contained dangerous malware. 

The corrupted ‘ctx’ package was initially discovered by Reddit user jimtk. Somdev Sangwan, an ethical hacker, also revealed that the PHP package ‘phpass’ h

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.