Malicious PyPI Package 'huggingface-cli' Steals API Tokens and SSH Keys
Overview
A malicious package named `huggingface-cli` was discovered on the Python Package Index (PyPI). This package was typosquatted to resemble the legitimate `huggingface_hub` library, which developers use to interact with the Hugging Face Hub. The malicious package contained code in its `setup.py` that executed upon installation (`pip install huggingface-cli`). The payload would scan the user's home directory for sensitive files commonly found in AI/ML developer environments. Specifically, it searched for `~/.huggingface/token` to steal Hugging Face API keys, `~/.aws/credentials` and `~/.aws/config` for Amazon Web Services credentials, and `~/.ssh/id_rsa` for private SSH keys. Once found, these files were base64 encoded and exfiltrated via an obfuscated HTTP POST request to an attacker-controlled server. The attack was designed to compromise developer accounts, enabling the attacker to steal private models, poison popular public models, or utilize the victim's cloud GPU resources for malicious purposes like crypto mining. The package was active for several days and garnered over 5,000 downloads before being identified and removed by the PyPI security team.
Affected Systems
Testing Guide
1. **Check Installed Packages**: Run `pip list` in your development environments and look for `huggingface-cli`. 2. **Review Shell History**: Check your shell history (e.g., `cat ~/.bash_history | grep 'pip install'`) for installations of the malicious package. 3. **Monitor Network Traffic**: If possible, review outbound network logs from developer machines for connections to unknown or suspicious domains shortly after Python packages were installed.
Mitigation Steps
1. **Scan Dependency Trees**: Use tools like `pip-audit` or Snyk to scan your project's dependencies for known malicious packages and typosquatting. 2. **Rotate Credentials**: If you believe you may have installed this package, immediately rotate all potentially compromised credentials, including Hugging Face API tokens, AWS IAM keys, and SSH keys. 3. **Use Virtual Environments**: Always install packages within a project-specific virtual environment (`venv`, `conda`) to contain the potential blast radius of a malicious package. 4. **Vet Packages**: Before installing a new package, check its download statistics, release history, and homepage link on PyPI to verify its legitimacy.
Patch Details
The package was removed from PyPI. The vulnerability exists on systems where it was installed.