Credential and Model Exfiltration via Malicious PyPI Package `torch-optimizer-pro`
Overview
A malicious package named `torch-optimizer-pro` was discovered on the Python Package Index (PyPI). It impersonated a legitimate, high-performance optimizer library for PyTorch, promising advanced training acceleration. The package's `setup.py` file contained an obfuscated payload that executed upon installation. This payload was designed to scan the user's environment for common credential files and environment variables, specifically targeting `~/.aws/credentials`, `~/.gcp/credentials.json`, and environment variables like `AWS_ACCESS_KEY_ID`, `OPENAI_API_KEY`, and `HUGGING_FACE_HUB_TOKEN`. If found, these credentials were encrypted and exfiltrated to a command-and-control (C2) server. Furthermore, the malware searched for common model file extensions (`.pth`, `.safetensors`, `.bin`) in the user's working directory and attempted to upload any proprietary models it found. This supply chain attack highlights the significant risk to organizations developing AI, as it can lead to immediate compromise of cloud infrastructure, theft of expensive proprietary models, and loss of sensitive training data. The package was downloaded several hundred times before being removed by the PyPI security team.
Affected Systems
Testing Guide
1. Run `pip list` in your development and production environments and search for the package `torch-optimizer-pro`. 2. Review your shell history and CI/CD logs for any instance of `pip install torch-optimizer-pro`. 3. Examine network logs for unexpected outbound connections to unfamiliar IP addresses or domains, especially following recent package installations or updates.
Mitigation Steps
1. Use `pip audit` or similar tools to continuously scan dependencies for known vulnerabilities. 2. Pin production dependencies to specific, vetted versions in a requirements file and use a hash-checking mode (`pip install --require-hashes`). 3. Where possible, use a private package repository (e.g., Artifactory, Nexus) to host a curated set of trusted third-party packages. 4. Educate developers on the risks of typosquatting and the importance of vetting new third-party libraries before installation.
Patch Details
The malicious package was removed from the PyPI registry. The mitigation is to ensure the package is uninstalled from all systems.