PyPI package 'ctx' and PHP library 'phpass' hijacked to obtain AWS keys

clock • 3 min read
PyPI package 'ctx' and PHP library 'phpass' hijacked to obtain AWS keys
Image:

PyPI package 'ctx' and PHP library 'phpass' hijacked to obtain AWS keys

Both attacks appears to be the work of the same actor

Security researchers this week identified two corrupt Python and PHP packages in what appears to be yet another instance of a software supply chain attack targeting the open-source ecosystem. Py...

To continue reading this article...

Join Computing

  • Unlimited access to real-time news, analysis and opinion from the technology industry
  • Receive important and breaking news in our daily newsletter
  • Be the first to hear about our events and awards programmes
  • Join live member only interviews with IT leaders at the ‘IT Lounge’; your chance to ask your burning tech questions and have them answered
  • Access to the Computing Delta hub providing market intelligence and research
  • Receive our members-only newsletter with exclusive opinion pieces from senior IT Leaders

Join now

 

Already a Computing member?

Login

You may also like
Bank of America admits data breach after supply chain hack

Security

Customer info exposed

clock 13 February 2024 • 2 min read
Labour frontbencher advocates for open source software and regulatory innovation

Government

Regulation can promote rather than stifle innovation, says Chi Onwurah

clock 08 February 2024 • 2 min read
'Open source must be part of AI future', Lords committee

Government

Open source is 'a key part of what UK businesses need to compete and thrive' says Baroness Stowell

clock 08 February 2024 • 4 min read

More on Threats and Risks

Ivanti VPN malware can survive a factory reset, warns CISA

Ivanti VPN malware can survive a factory reset, warns CISA

'Assume a sophisticated threat actor may deploy rootkit level persistence'

John Leonard
clock 01 March 2024 • 2 min read
Hugging Face AI platform infested with 100 malicious code-execution models, researchers warn

Hugging Face AI platform infested with 100 malicious code-execution models, researchers warn

These models could create a persistent backdoor for attackers

clock 01 March 2024 • 3 min read
US, UK, Canada seek global coalition to combat state disinformation

US, UK, Canada seek global coalition to combat state disinformation

US, UK and Canada have endorsed a framework to tackle information manipulation

clock 27 February 2024 • 3 min read