# PyPI (Python Infrastructure): Malicious takeover of ctx project on PyPI.

- Impact (vendor’s label): none
- Status: postmortem
- Started: 2022-05-24 17:32 UTC · Resolved: 2022-05-24 10:00 UTC · Duration: -453 min
- Updates: 2
- [Vendor status page: https://stspg.io/pn714s4b42d3](https://stspg.io/pn714s4b42d3)
- [Company: PyPI (Python Infrastructure)](https://rewindex.com/company/pypi.md)

## Timeline of updates

- **resolved** 2022-05-24 10:00 UTC: This incident has been resolved.
- **postmortem** 2022-05-24 17:33 UTC: Takeover of the ctx project was reported on multiple channels overnight and was mitigated as of 6:07 AM Eastern. We confirmed via investigation that this compromise was of a single user account due to re-registration over an expired domain. The domain that hosted the users email address was re-registered 2022-05-14T18:40:05Z and a password reset completed successfully for the user at 2022-05-14T18:52:40Z. Original releases were then deleted and malicious copies uploaded. PyPI itself was not directly compromised. Read the full incident report at \[https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html\](https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html).


---
Canonical: https://rewindex.com/company/pypi/incidents/s8vm6pwr46c2 · Markdown: https://rewindex.com/company/pypi/incidents/s8vm6pwr46c2.md · JSON: https://rewindex.com/api/v1/companies/pypi/incidents/s8vm6pwr46c2 · Generated 2026-10-20T02:20:31.090Z