Credential Theft via Malicious Typosquatted Packages in PyPI Targeting AI Developers
Overview
A widespread and ongoing supply chain attack campaign has been identified targeting AI and machine learning developers through typosquatted packages on the Python Package Index (PyPI). Attackers publish packages with names that are common misspellings or variations of popular libraries such as `tensorflow-gpu`, `python-dotenv`, `pytorch-lightning`, and `huggingface-hub`. For example, a package might be named `torch-vision` instead of the legitimate `torchvision`. When a developer mistakenly installs the malicious package via `pip install`, the package's `setup.py` script or an `__init__.py` file executes a malicious payload. The primary goal of these attacks is credential theft. The scripts are designed to scan the developer's environment for sensitive information, including environment variables (e.g., `OPENAI_API_KEY`, `AWS_SECRET_ACCESS_KEY`, `HUGGING_FACE_HUB_TOKEN`), configuration files (`.gitconfig`, `.npmrc`), and SSH keys (`~/.ssh`). Once found, this information is exfiltrated to an attacker-controlled server. This allows attackers to take over cloud accounts, access private code repositories, and abuse expensive API quotas for LLMs and other AI services. This highlights the critical need for dependency hygiene in AI development workflows, especially in CI/CD pipelines where service credentials are often exposed as environment variables.
Affected Systems
Testing Guide
1. Audit your project's `requirements.txt` file and your global pip cache for any packages with suspicious or misspelled names. 2. Run an audit tool on your project's dependencies: ```bash pip install pip-audit pip-audit ``` 3. Review the output for any alerts related to known malicious packages. 4. Manually check the names of all dependencies against their official PyPI entries.
Mitigation Steps
1. **Use Lock Files:** Always use `requirements.txt` or `poetry.lock` files to pin exact, vetted versions of dependencies. This prevents accidental installation of typosquatted packages. 2. **Vet Dependencies:** Before adding a new dependency, verify its authenticity on PyPI. Check the author, download statistics, project links, and release history. 3. **Use Scanners:** Integrate automated security scanning tools like `pip-audit` or Snyk into your CI/CD pipeline to check for known malicious or vulnerable packages. 4. **Limit Permissions:** In CI/CD environments, use short-lived, narrowly-scoped credentials instead of long-lived static secrets. Do not store secrets in source code.
Patch Details
This is an ongoing attack pattern. Malicious packages are removed by PyPI admins upon discovery, but new ones are constantly uploaded.