Would you have caught the ctx and ua-parser-js package hijacks?

Only if you had controls on new versions of trusted packages. In both cases the attacker published a malicious release under a legitimate package name after taking over a maintainer's account: ua-parser-js on npm in October 2021, and ctx on PyPI in May 2022. Pinning, lockfiles and secret hygiene limit the damage.

What happened with ua-parser-js?

CISA's alert of 22 October 2021 says versions 0.7.29, 0.8.0 and 1.0.0 of the ua-parser-js npm package contained malicious code, and urged users to move to 0.7.30, 0.8.1 or 1.0.1. CERT-EU adds that the maintainer said his npm account had been hijacked, and reports describe cryptominers and password-stealing trojans, delivered by an install script. Note that the topic is often written as "ua-parser." The affected package we confirmed is the npm one, ua-parser-js. We did not find a matching PyPI event.

What happened with ctx?

Per The Hacker News, the ctx Python package had last been published in December 2014. In May 2022 an attacker registered the expired domain tied to the maintainer's email, used a password reset to reach the PyPI account, removed the old package and uploaded modified versions. The malicious code collected environment variables, encoded them and sent them to a web app, aiming mainly at AWS credentials. A researcher later claimed responsibility and said the data was deleted. Whatever the intent, the code did what it did, so treat any exposure as real.

What do the two have in common?

A trusted name, a changed version and a login that was not the maintainer's. Neither needed a vulnerability in your code. Both ran at install time or import time on machines that held secrets.

Would you have caught them? Questions to ask

• Do your builds install exact versions from a lockfile, so a new release is not pulled automatically?
• Is there a delay, such as a few days, before you adopt a brand new version of a dependency?
• Do install scripts run in your CI, and does the CI hold cloud credentials?
• Could you tell, today, which of your projects used ctx or ua-parser-js in the affected windows?
• Do you flag packages that have been dormant for years and then suddenly release?
• Are cloud credentials long lived, or short lived and scoped?

What to do

1. Commit lockfiles and install from them in CI.
2. Add a cooldown policy for brand new releases of dependencies, with an easy override for urgent security fixes.
3. Disable install scripts where you can, and run builds with short lived, narrow credentials.
4. Keep an inventory so you can answer "do we use package X, which version" in minutes.
5. Alert on dormant packages that publish a new version.
6. If you used an affected version, treat the machine as exposed: rotate credentials that were in its environment, then rebuild it.
7. For packages you maintain, use two-factor authentication on the registry account and keep the email domain registered.

Where does Safeguard help?

Safeguard generates a software inventory and scans dependencies, and the free in-browser scan at gold.safeguard.sh/scan covers up to 100 dependencies. That helps with question 4. Preventing a maintainer account takeover is up to the registry and the maintainer.

Quick check

Sources

• CISA, Malware Discovered in Popular NPM Package, ua-parser-js
• The Hacker News, PyPI package ctx and PHP library phpass hijacked
• CERT-EU Security Advisory 2021-057

Last reviewed: 18 October 2026.