Malicious PyPI Package `huggingface-cli` Steals Cloud Credentials and API Keys
Overview
A typosquatting attack was identified on the Python Package Index (PyPI) involving a malicious package named `huggingface-cli`. The package mimicked the legitimate and widely used `huggingface_hub` library, aiming to trick developers into installing it by mistake. The malicious package contained a `setup.py` file with obfuscated code that executed upon installation. This code was designed to scan the developer's environment for sensitive information, specifically targeting environment variables and configuration files commonly used in AI/ML development. It searched for patterns matching `OPENAI_API_KEY`, `HUGGINGFACE_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and Google Cloud credential files. Once found, this sensitive information was base64 encoded and exfiltrated to a command-and-control (C2) server controlled by the attacker via an HTTPS POST request. The impact is critical, as compromised credentials could lead to unauthorized access to expensive GPU resources, theft of proprietary models and data, and further infiltration of cloud infrastructure. The package was quickly identified by security researchers and removed from PyPI, but any system where it was installed remains compromised until credentials are rotated and the system is audited. This incident highlights the growing threat of supply chain attacks targeting the AI developer ecosystem.
Affected Systems
Testing Guide
1. Check your installed packages for `huggingface-cli`: `pip freeze | grep "huggingface-cli"`. 2. Review shell history (`history | grep "pip install huggingface-cli"`) on developer machines and CI/CD runners to see if the package was ever installed. 3. Audit outbound network traffic logs from developer machines and build systems for requests to unknown or suspicious domains around the time of installation. 4. If the package was installed, assume all environment variables and secrets on the machine have been compromised.
Mitigation Steps
1. Immediately uninstall the `huggingface-cli` package if present: `pip uninstall huggingface-cli`. 2. Rotate all potentially compromised credentials, including cloud provider keys (AWS, GCP, Azure), OpenAI keys, and Hugging Face tokens. 3. Use dependency scanning tools like `pip-audit` or commercial solutions to detect malicious or vulnerable packages. 4. Enforce strict policies for installing third-party packages. Use a private package repository with vetted packages where possible. 5. Always verify the package name for typos before installation. Check download statistics and release history on PyPI.
Patch Details
The malicious package has been removed from the PyPI registry. No patch is required for the legitimate `huggingface_hub` library.