Credential Theft Campaign via Typosquatted `torch-utils` and `pandas-ml` Packages on PyPI
Overview
A malicious software campaign was identified on the Python Package Index (PyPI), targeting AI and data science developers through typosquatting. Attackers published several packages with names closely mimicking legitimate, popular libraries, such as `torch-utils` instead of `torch.utils`, `pandas-ml` instead of `pandas`, and `scikit-learnn` instead of `scikit-learn`. The malicious code was embedded within the `setup.py` file, ensuring its execution upon `pip install`. The payload was a sophisticated infostealer that scanned the developer's machine for sensitive information. It targeted common locations for cloud credentials (`~/.aws/credentials`, `~/.gcp/`, `~/.azure/`), SSH keys (`~/.ssh/`), shell history files, and environment variables. The stolen data was then compressed and exfiltrated to an attacker-controlled command-and-control (C2) server. This campaign highlights the significant supply chain risk for organizations heavily invested in AI development, as a single compromised developer machine can lead to the loss of valuable intellectual property, training data, and access to production cloud infrastructure. The packages were active for several weeks before being discovered and removed by the PyPI security team.
Affected Systems
Testing Guide
1. Review the output of `pip list` in your development and production environments for any packages with suspicious or misspelled names. 2. Cross-reference your project's `requirements.txt` file against the official names of the libraries on PyPI. 3. If a suspicious package is found, do not uninstall it immediately (as the uninstaller could also contain malicious code). Instead, disconnect the machine from the network and perform a full security incident response analysis.
Mitigation Steps
1. Use dependency analysis tools like `pip-audit` or `safety` to scan `requirements.txt` and `pyproject.toml` files for known malicious or vulnerable packages. 2. Pin project dependencies to specific, known-good versions and use hash-checking with a `requirements.txt` file (`--require-hashes`). 3. Whenever possible, source packages from a trusted, internally managed artifact repository that vets and mirrors a subset of public PyPI packages. 4. Carefully vet all new dependencies. Scrutinize package names for typos and check download statistics and release history on PyPI before installation.
Patch Details
The malicious packages were removed from PyPI by their security team on 2025-09-16. However, any systems where the packages were installed remain compromised until remediated.