The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.

References

• https://github.com/pypa/advisory-database/tree/main/vulns/ctx/PYSEC-2022-199.yaml
• https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html