Security News > 2022 > May > Hijacking of popular ctx and phpass packages reveals open source security gaps
The Python module "Ctx" and a fork of the PHP library "Phpass" have recently been modified by an unknown attacker to grab AWS credentials/keys and send them to a Heroku app.
What at first seemed like the work of a malicious actor turned out to be an exploit by a security researcher, who wanted to demonstrate how easy it is to take control of popular packages and the repositories hosting them.
In this Help Net Security video, Ax Sharma, Senior Security Researcher at Sonatype, talks about the tactics used by the researcher Yunus Aydin and what they revealed about the security gaps that can be misused to mount supply chain compromises affecting the open source community.
He also offers advice for users of third-party open source packages.
News URL
https://www.helpnetsecurity.com/2022/05/26/hijacking-open-source-packages/
Related news
- Sara: Open-source RouterOS security inspector (source)
- What’s Next for Open Source Software Security in 2025? (source)
- GitHub CISO on security strategy and collaborating with the open-source community (source)
- Fleet: Open-source platform for IT and security teams (source)
- Orbit: Open-source Nuclei security scanning and automation platform (source)