Encyclopedia
PyPI⚠ HIGHphantom⚠ ACTIVE THREAT

ctx

First seen: Oct 6, 2026 0 viewsMimics: internal package name (varies per victim)
Share threatHN
Threat Description

A dependency-confusion (phantom) package on PyPI, part of the 2021 dependency-confusion research by Alex Birsan that affected companies including Apple, Microsoft, and PayPal. The attacker registered a public package with the same name as a company's internal-only dependency, so package managers fetched the malicious public version and ran arbitrary code at install time.

AI Hallucination Analysis
Unlikely AI Hallucination0%
Known to be hallucinated by: None - this is a real dependency-confusion attack, not an AI hallucination.
Remediation Guide
  1. Remove the public ctx package and ensure internal packages resolve from a private registry before public. 2. Audit for dependency-confusion exposure across all package managers. 3. Use scoped/private registries with precedence rules. 4. Pin internal dependencies by hash.
View on registry
Quick Facts
Ecosystem
PyPI
Risk Level
HIGH
Type
phantom
Status
ACTIVE
Legitimate Package
internal package name (varies per victim)
Hallucination Confidence
0%
Check My Project
Scan for this package