Malicious PyPI Package 'huggingface-cli' Steals API Keys and Cloud Credentials
Overview
A malicious typosquat package named 'huggingface-cli' was discovered on the Python Package Index (PyPI). The package mimicked the legitimate 'huggingface_hub' library, which provides a command-line interface for interacting with the Hugging Face Hub. The malicious package contained obfuscated code within its `setup.py` file that executed upon installation via `pip install huggingface-cli`. The code was designed to scan the user's environment for sensitive information, specifically targeting environment variables commonly used in AI/ML development. It searched for and exfiltrated API keys for services like OpenAI, Anthropic, Cohere, and Hugging Face, as well as credentials for cloud providers such as AWS (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) and Google Cloud. The stolen credentials were base64 encoded and sent via an HTTP POST request to a remote server controlled by the attacker. This type of supply chain attack is particularly dangerous as it compromises the developer's machine and provides the attacker with direct access to powerful and costly AI models and cloud infrastructure, potentially leading to significant financial loss, data breaches, and unauthorized model usage. The package was quickly removed by PyPI security staff after being reported, but anyone who installed it during its availability is considered compromised.
Affected Systems
Testing Guide
1. Check your installed Python packages for `huggingface-cli` by running `pip freeze | grep huggingface-cli`. 2. Review your project's `requirements.txt` or `pyproject.toml` files for any mention of the package. 3. Examine your network logs for outgoing POST requests to unfamiliar domains around the time of any new package installations. The malicious package was observed sending data to `pypi-telemetry.com`.
Mitigation Steps
1. Immediately uninstall the malicious package from all systems: `pip uninstall huggingface-cli`. 2. Audit system logs and shell history to determine if the package was installed. 3. Rotate all potentially compromised credentials, including API keys for OpenAI, Hugging Face, Anthropic, etc., and IAM credentials for AWS, GCP, and Azure. 4. Implement stricter package management policies, such as using a private package repository with vetted packages or using tools like `pip-audit` to scan for known malicious packages. 5. Educate developers on the dangers of typosquatting and the importance of verifying package names before installation.
Patch Details
The package was removed from the PyPI registry. There is no 'patched' version; the package should be completely removed.