Malicious PyPI Package 'huggingface-cli' Steals API Keys and SSH Credentials
Overview
A malicious typosquatting package named `huggingface-cli` was discovered on the Python Package Index (PyPI). This package mimicked the legitimate `huggingface_hub` library, which is a core dependency for interacting with the Hugging Face Hub. The malicious package used a `setup.py` script that executed a remote payload upon installation via `pip install huggingface-cli`. The downloaded payload scanned the user's home directory for common environment files (`.env`), shell history files (`.bash_history`, `.zsh_history`), and configuration directories (`~/.aws/`, `~/.gcp/`, `~/.ssh/`). It specifically searched for patterns matching Hugging Face API tokens, OpenAI API keys, AWS credentials, and private SSH keys. Once found, this sensitive information was base64 encoded and exfiltrated to a hardcoded command-and-control server. The package was downloaded over 5,000 times before being reported and removed by the PyPI security team. This incident highlights the significant supply chain risk for AI/ML developers, who frequently install numerous open-source packages and often store sensitive credentials in predictable locations. The discovery was made by an independent security researcher who noticed the suspicious package while searching for official Hugging Face tooling.
Affected Systems
Testing Guide
1. Run the command `pip list | grep huggingface-cli` in your Python environments. 2. If the package is present, your system is affected. 3. Check your shell history for `pip install huggingface-cli`. 4. Monitor outbound network traffic for connections to unknown or suspicious endpoints, especially after Python package installations.
Mitigation Steps
1. Immediately run `pip uninstall huggingface-cli` to remove the malicious package. 2. Assume any secrets found on the affected machine are compromised. Rotate all API keys (Hugging Face, OpenAI, Anthropic, etc.), cloud credentials (AWS, GCP, Azure), and SSH keys. 3. Scan home directories and project folders for any residual malicious scripts. 4. In the future, use tools like `pip-audit` or Snyk to scan dependencies for known vulnerabilities and malicious packages. 5. Always double-check package names for typos before installation, referencing official documentation.
Patch Details
The malicious package 'huggingface-cli' was removed from the PyPI registry on 2026-06-04.