Part 51 · Module 7: Modules, the Standard Library and Packages

Incident: A trusted package changed hands

7 min read·14 Oct 2026

Module 7 · Incident file · About 30 minutes

What happened

The ctx takeover in order: an abandoned package (grey) passed to a new owner (amber, uncertain), whose new versions were installed and sent secrets away (red).

In May 2022 the Python Package Index, PyPI, reported on its blog that a package called ctx had been taken over. ctx was an old package that its author had stopped working on. Someone else gained control of it and published new versions under the same name.

Those new versions did something the old ones never did. When they ran, they collected the computer's environment variables, the named settings every program can read, and sent them to the attacker. Environment variables often hold secrets, such as passwords and access keys for online services, so those secrets went too.

The trusted name stayed the same; only the code behind it changed, from the original author's (green) to the new owner's (red).

This file keeps to those facts; the PyPI blog post of May 2022 tells the full story. What matters here is the shape of the failure. Nobody installed a stranger's package. People installed a name they already trusted, and the code behind the name had changed.

What happened

The rest of this part opens with an account