Credential Exfiltration via Malicious PyPI Package 'torch-optimizer' Targeting AI Developers
Overview
A critical supply chain attack was identified involving a malicious package named `torch-optimizer` published to the Python Package Index (PyPI). The package typosquatted the legitimate and popular `torch_optimizer` library (with an underscore instead of a dash). The attacker's package mirrored the functionality of the original to avoid immediate suspicion, but included a malicious payload in its `setup.py` file. This payload was executed during the package installation process (`pip install torch-optimizer`). The malicious code would scan the user's environment variables for common credential patterns, specifically targeting `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `HF_TOKEN` (Hugging Face), `OPENAI_API_KEY`, and `GCP_SERVICE_ACCOUNT`. Upon finding these credentials, the script would Base64-encode them and exfiltrate the data via an HTTP POST request to an attacker-controlled server. This attack was highly effective because AI and ML developers frequently store these sensitive keys in their environment variables for easy access by SDKs and development tools. The incident underscores the persistent threat of typosquatting in open-source registries and the need for developers to be vigilant about the exact names of the packages they install. The package was downloaded several hundred times before being identified and removed by the PyPI security team.
Affected Systems
Testing Guide
1. **Check Installed Packages:** Run `pip freeze | grep torch-optimizer` in your Python environments. If this package is present, you are affected. 2. **Review Shell History:** Check your shell history (`history | grep 'pip install torch-optimizer'`) for accidental installation of the malicious package. 3. **Audit Credentials:** If you suspect you may have been affected, immediately rotate all potentially exposed API keys and secrets (AWS, Hugging Face, OpenAI, etc.) and audit for any unauthorized activity.
Mitigation Steps
1. **Verify Package Names:** Always double-check the spelling of package names before installation. Use the official documentation as the source of truth for installation commands. 2. **Use Pinned Dependencies:** Use a `requirements.txt` or `pyproject.toml` file with pinned versions and hashes (`pip-compile`) to ensure you are installing the exact, verified packages you expect. 3. **Use Scoped/Temporary Credentials:** Avoid storing long-lived, high-privilege credentials in environment variables. Use tools that provide short-lived, temporary credentials where possible (e.g., AWS IAM roles, `aws-vault`). 4. **Monitor Network Traffic:** During CI/CD builds and in development environments, monitor outbound network traffic for connections to unknown or suspicious domains.
Patch Details
The malicious package `torch-optimizer` was removed from PyPI by the security team on 2026-06-26.