Credential Exfiltration via Malicious PyPI Package 'torch-optimizer'
Overview
A malicious package was discovered on the Python Package Index (PyPI) named `torch-optimizer`, typosquatting the legitimate and popular `torch_optimizer` library used by machine learning developers. The malicious package replicated the legitimate package's functionality to avoid immediate detection but included an obfuscated payload in its `setup.py` file. Upon installation (`pip install torch-optimizer`), the malicious script would execute. The script was designed to scan the user's environment for sensitive information commonly found on an AI developer's machine. It specifically searched for environment variables and configuration files related to AWS (`~/.aws/credentials`), Google Cloud (`gcloud`), Azure (`~/.azure`), and Hugging Face (`~/.cache/huggingface/token`). If found, these credentials and API tokens were base64 encoded and exfiltrated to a command-and-control (C2) server controlled by the attacker. This type of supply chain attack is particularly dangerous as it compromises the developer's machine and potentially their cloud infrastructure, leading to large-scale data breaches or abuse of expensive GPU compute resources. The package was reported by the community and promptly removed by the PyPI security team, but not before it was downloaded several hundred times.
Affected Systems
Testing Guide
1. **Check Installed Packages**: Run `pip freeze | grep torch-optimizer` in your Python environments. If the package `torch-optimizer` (with a hyphen) is found, your system may have been compromised. 2. **Remove Package**: Immediately run `pip uninstall torch-optimizer`. 3. **Rotate Credentials**: If the package was installed, assume all credentials (AWS, GCP, Hugging Face, etc.) on the machine have been compromised and rotate them immediately. 4. **Analyze Network Logs**: Check outbound network logs from the time of installation for suspicious connections to unknown domains.
Mitigation Steps
1. **Verify Package Names**: Always double-check the spelling of package names before installation. Use official documentation as the source of truth for installation commands. 2. **Use Pinned Dependencies**: Use a `requirements.txt` or `pyproject.toml` file with pinned, hashed versions of dependencies (`pip-tools`, `poetry`) to ensure you are installing exactly the package you vetted. 3. **Scan Dependencies**: Integrate automated dependency scanning tools like `pip-audit` or Snyk into your development and CI/CD workflows to check for known malicious packages. 4. **Restrict Permissions**: Run development and build processes with the least privilege necessary. Avoid storing long-lived, high-privilege credentials as environment variables; use temporary credentials where possible.
Patch Details
The malicious package `torch-optimizer` was removed from the PyPI registry by the PyPI security team on 2025-10-23.