When a GitHub repository that hasn’t been touched for almost a decade suddenly gets an “update”, users should be wary, as it might just be a hostile takeover with the intention of distributing viruses (opens in new tab).
That’s exactly what happened to the PyPI module “ctx”, which apparently has millions of downloads. Earlier this month, following a software supply chain attack, someone replaced the safe “ctx” code with an updated version that steals developer environment variables and collects secrets such as Amazon AWS keys and credentials.
These are then sent to a Heroku endpoint (opens in new tab)at https://anti-theft-web.herokuapp[.]com/hacked/
Repo jacking
The attack, first spotted by BleepingComputer, resulted in some 20,000 downloads.
Besides “ctx”, versions of “phpass” that were published to the PHP/Composer package repository Packagist have also been “updated” in the same way. This one also has millions of downloads.
CTX is a Python module whose last update happened in 2014. Then, eight years later, on May 15, the module was updated with a malicious code, as was spotted by Reddit users, and later confirmed by ethical hackers. PHPass, on the other hand, is an open-source password hashing framework, released in 2005, and downloaded more than two million times, so far.
PyPI took down the malicious versions a few hours after they were uploaded to the repository, but the damage had already been done, it was said. The damage done via PHPass was a lot more limited, researchers added.
Researchers are claiming both attacks were done by the same person, whose identity is “obvious”, but are refraining from naming any names before more details are unveiled.
Researchers are dubbing these types of attacks as “repo jacking” (repository hijacking), and these are hardly their first examples. Earlier this year, popular npm libraries ua-parser-js, coa, and rc have all been repo jacked to serve cryptocurrency miners and infostealers to their victims.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba