Malicious PyPI Package 'huggingface-cli' Steals Developer Credentials and API Keys
Overview
A malicious package named `huggingface-cli` was discovered on the Python Package Index (PyPI). This package typosquatted the legitimate and popular `huggingface_hub` library, which provides command-line tools for interacting with the Hugging Face Hub. The malicious package mirrored the functionality of the real library to avoid immediate detection but included a hidden payload in its `setup.py` file. Upon installation via `pip install huggingface-cli`, this payload would execute. The malicious code was designed to scan the developer's environment for sensitive information, specifically targeting environment variables and configuration files associated with AI development. It searched for patterns matching `OPENAI_API_KEY`, `HUGGING_FACE_HUB_TOKEN`, `AWS_ACCESS_KEY_ID`, and `GCP_PROJECT`. Once found, these credentials were exfiltrated via a DNS tunnel to a remote command-and-control (C2) server controlled by the attacker. The attack's impact is critical, as stolen credentials could lead to fraudulent usage of expensive LLM APIs, unauthorized access to private models and data on cloud platforms, and further compromise of organizational infrastructure. The package was active for approximately 72 hours before being reported by security researchers and removed by the PyPI security team.
Affected Systems
Testing Guide
1. Check if the package is installed by running `pip list | grep huggingface-cli`. 2. If it is or was present, review your local `~/.bash_history` or `~/.zsh_history` and CI/CD pipeline logs for evidence of the `pip install huggingface-cli` command. 3. Monitor outbound network traffic for suspicious DNS lookups or HTTP requests to unknown domains, which could indicate data exfiltration.
Mitigation Steps
1. Immediately run `pip uninstall huggingface-cli` in all developer environments. 2. Check shell history and CI/CD logs for installations of this package. 3. If the package was installed, assume all relevant secrets (`OPENAI_API_KEY`, `HUGGING_FACE_HUB_TOKEN`, cloud credentials) have been compromised. Rotate these keys immediately. 4. Implement dependency scanning tools like `pip-audit` or Snyk to check for known malicious or vulnerable packages. 5. Educate developers on the dangers of typosquatting and encourage copying package names directly from official sources.
Patch Details
The malicious package was removed from the PyPI registry by the PyPI security team on 2026-06-16.