The information security community was sent into a panic on May 24, 2022, when a Reddit user discovered that popular but out-of-date Python library “ctx” had been updated to include malicious AWS secret stealer code. A security researcher also found a PHP library called “PHPass” with a similar code sending the stolen data to the exact same endpoint. The supposed threat actor also replaced the original developers name with their own and leaked their own contact information on the Heroku endpoint used by the malware. One (1) day after the attack, a medium account named “SockPuppets” posted a blog post titled “How I hacked CTX and PHPass Modules.” The author, identified as Yunus Aydın, claimed to be a security researcher conducting non-malicious research into a vulnerability. Following the release of the article, many researchers and professionals in the information security community spoke out against the use of the exfiltration of AWS secret keys. Bug bounty hunter @h4x0r_dz tweeted “What you did to show the impact was wrong!” Aydin stated that “ALL THE DATA THAT I RECEIVED IS DELETED AND NOT USED,” but provided no way for impacted organizations to confirm their secret information was not deleted, leaving them to rotate all credentials stolen by the malware. These real-world costs could have been avoided with a simpler payload, such as a log entry or basic fingerprinting information. Aydin submitted their research as a report to GitHub on HackerOne, though it was closed as a duplicate shortly after. Seemingly good faith research conducted in this way can cost companies time and money fixing the mess the researcher leaves behind following their testing. This incident follows the changes to the Computer Fraud and Abuse Act (CFAA) allowing good faith security research to be conducted without punishment but it’s not clear at this point whether this would fall under “good faith research.”