Malicious PyPI Package 'huggingface-cli' Used for Credential and Model Theft
Overview
A sophisticated supply chain attack was identified targeting AI/ML developers through a malicious package named `huggingface-cli` uploaded to the Python Package Index (PyPI). The package typosquatted the legitimate and popular `huggingface_hub` library, which contains a command-line utility. The malicious package replicated the legitimate CLI's basic functionality to avoid immediate suspicion. However, its `setup.py` script contained an obfuscated payload that executed upon installation (`pip install huggingface-cli`). The payload would scan the user's home directory for sensitive files, specifically targeting `~/.git-credentials`, `~/.docker/config.json`, and `~/.huggingface/token`. It also searched for environment variables commonly used for cloud access, such as `AWS_ACCESS_KEY_ID` and `GOOGLE_APPLICATION_CREDENTIALS`. All discovered credentials and tokens were base64 encoded and exfiltrated via a DNS tunnel to a command-and-control server. The attack's goal was to gain unauthorized access to private model repositories, cloud GPU resources, and proprietary datasets. The package was discovered after a developer noticed unusual network traffic following its installation.
Affected Systems
Testing Guide
1. Run `pip list | grep huggingface-cli` in your terminal or command prompt to check if the malicious package is installed. 2. Review your shell history (`history | grep 'pip install huggingface-cli'`) for installation commands. 3. Check your system's DNS query logs for unusual or long, encoded subdomains being queried.
Mitigation Steps
1. Immediately remove the package from your system: `pip uninstall huggingface-cli`. 2. Rotate all Hugging Face API tokens, Git credentials, and any cloud provider credentials found on the affected machine. 3. Audit systems for signs of compromise or unauthorized access, paying close attention to cloud and repository logs. 4. Implement a policy of using `--index-url` to install packages from a trusted internal repository rather than the public PyPI where possible. 5. Use tools like `pip-audit` or `dependency-check` in your CI/CD pipeline to scan for known malicious packages.
Patch Details
The malicious package was removed from PyPI by the registry's security team on 2026-06-06. However, any system where it was installed remains compromised until cleaned and credentials are rotated.