Malicious PyPI Package 'huggingface-cli' Exfiltrates AI/ML Developer Credentials
Overview
A malicious package named 'huggingface-cli' was discovered on the Python Package Index (PyPI), typosquatting the legitimate 'huggingface-hub' library. The package's setup.py file contained an obfuscated payload that executed upon installation via 'pip install'. The payload was designed to target AI and Machine Learning developers by systematically scanning the user's home directory and environment variables for sensitive credentials. It specifically searched for API keys related to OpenAI, Anthropic, Cohere, and Hugging Face, as well as cloud credentials for AWS, Google Cloud, and Azure stored in common locations (e.g., ~/.aws/credentials, environment variables). Upon finding these credentials, the script would base64 encode them and exfiltrate the data via a DNS tunnel to a command-and-control (C2) server controlled by the attacker. This type of supply chain attack is particularly effective against AI developers who often handle powerful API keys and cloud service accounts with broad permissions for training and inference tasks. The package was active for approximately 72 hours and received several hundred downloads before being removed by the PyPI security team following reports from the community.
Affected Systems
Testing Guide
1. Run the command `pip list | grep huggingface-cli` in your project's virtual environment to check for the presence of the malicious package. 2. Audit your shell history for commands like `pip install huggingface-cli`. 3. Examine logs from network monitoring tools for suspicious DNS queries to unknown domains, which could indicate data exfiltration via DNS tunneling.
Mitigation Steps
1. Immediately check your project's dependencies for the 'huggingface-cli' package. If present, remove it and assume all local credentials have been compromised. 2. Rotate all potentially exposed credentials, including cloud provider access keys, database passwords, and LLM provider API keys. 3. Implement stricter dependency management policies. Use a requirements.txt or pyproject.toml file with pinned, hashed versions of dependencies. 4. Use tools like `pip-audit` or Snyk to scan dependencies for known vulnerabilities and malicious packages before installation and in CI/CD pipelines. 5. Consider using isolated or containerized development environments to limit the blast radius of a compromised dependency.
Patch Details
The malicious package has been removed from the PyPI registry. No patch is required beyond removing the package from local systems.