PyPI package 'ctx' and PHP library 'phpass' hijacked to obtain AWS keys

clock • 3 min read
PyPI package 'ctx' and PHP library 'phpass' hijacked to obtain AWS keys
Image:

PyPI package 'ctx' and PHP library 'phpass' hijacked to obtain AWS keys

Both attacks appears to be the work of the same actor

Security researchers this week identified two corrupt Python and PHP packages in what appears to be yet another instance of a software supply chain attack targeting the open-source ecosystem. Py...

To continue reading this article...

Join Computing

  • Unlimited access to real-time news, analysis and opinion from the technology industry
  • Receive important and breaking news in our daily newsletter
  • Be the first to hear about our events and awards programmes
  • Join live member only interviews with IT leaders at the ‘IT Lounge’; your chance to ask your burning tech questions and have them answered
  • Access to the Computing Delta hub providing market intelligence and research
  • Receive our members-only newsletter with exclusive opinion pieces from senior IT Leaders

Join now

 

Already a Computing member?

Login

You may also like
Harnessing the 'irrational exhuberance' around AI - CNCF's Priyanka Sharma

Business Software

CNCF chief on meeting the sky high expecations of genAI

clock 20 March 2024 • 4 min read
Lazarus uploading malware to open-source PyPl software repository

Threats and Risks

Supply chain attack leaves developers in Asia at particular risk

clock 12 March 2024 • 3 min read
The language of software licencing needs an upgrade, says Percona's Peter Zaitsev

Open Source

Third-way models are proliferating

clock 05 March 2024 • 3 min read

More on Threats and Risks

Apple M-series CPU vulnerability enables attackers to purloin cryptographic keys from Macs

Apple M-series CPU vulnerability enables attackers to purloin cryptographic keys from Macs

US researchers find baked-in flaw

Graeme Burton
clock 22 March 2024 • 2 min read
US National Security Advisor Jake Sullivan warns of 'digital Pearl Harbor' targeting infrastructure

US National Security Advisor Jake Sullivan warns of 'digital Pearl Harbor' targeting infrastructure

White House warns of 'disabling cyberattacks' by Iran and China

Graeme Burton
clock 21 March 2024 • 3 min read
Fujitsu exposed client data, AWS keys and passwords for nearly a year, report

Fujitsu exposed client data, AWS keys and passwords for nearly a year, report

Unanswered questions about how many unauthorised parties may have accessed the sensitive information

clock 21 March 2024 • 3 min read