Critical RCE via Malicious PyPI Package `torch-utils` Targeting AI/ML Developers
Overview
A malicious package named `torch-utils` was discovered on the Python Package Index (PyPI). The package was typosquatted to impersonate a legitimate utility library for PyTorch users. Upon installation via `pip install torch-utils`, the package's `setup.py` script would execute a malicious payload. This payload was designed to exfiltrate sensitive information from the developer's environment, specifically targeting secrets used in AI development. It scanned for environment variables such as `OPENAI_API_KEY`, `HUGGING_FACE_HUB_TOKEN`, `AWS_SECRET_ACCESS_KEY`, and `GCP_SERVICE_ACCOUNT_KEY`. Additionally, it searched for local Kubernetes configuration files (`~/.kube/config`) and SSH private keys. All discovered credentials and keys were base64 encoded and sent to a command-and-control (C2) server controlled by the attacker. This type of supply chain attack is particularly effective against the AI/ML community, as developers frequently install numerous open-source packages and often store high-value cloud and API credentials in their local environment. The impact is critical, as a successful attack could lead to complete compromise of cloud infrastructure, theft of proprietary models and data, and significant financial loss.
Affected Systems
Testing Guide
1. Run `pip list | grep torch-utils` in your Python environments to check if the malicious package is installed. 2. Search your shell history for `pip install torch-utils`. 3. Monitor outbound network traffic from developer machines and CI/CD runners for suspicious connections immediately after package installation.
Mitigation Steps
1. Immediately check your project dependencies for the presence of `torch-utils` and remove it. 2. Rotate any API keys, cloud credentials, or SSH keys that may have been stored on affected machines. 3. Use tools like `pip-audit` or Snyk to scan dependencies for known malicious packages before installation. 4. Pin dependency versions in `requirements.txt` or `pyproject.toml` to prevent unexpected package updates. 5. When possible, install packages in isolated and sandboxed environments.
Patch Details
The malicious package was removed from PyPI by the security team on 2026-06-19.