Malicious PyPI Package 'huggingface-tranformers' Steals Cloud Credentials
Overview
A malicious package named `huggingface-tranformers` was discovered on the Python Package Index (PyPI), typosquatting the immensely popular `huggingface-transformers` library. The malicious package perfectly mirrored the legitimate package's metadata, making it difficult to distinguish at a glance. However, its `setup.py` script contained obfuscated code that executed upon installation. This malicious payload was designed to scan common locations for developer credentials, including environment variables (e.g., `AWS_ACCESS_KEY_ID`, `OPENAI_API_KEY`), dotfiles (`~/.aws/credentials`, `~/.gitconfig`), and Kubernetes configuration files (`~/.kube/config`). Upon finding credentials, the script would exfiltrate them via a base64-encoded payload to a command-and-control (C2) server hosted on a compromised domain. This type of supply chain attack is particularly dangerous for the AI/ML community, where developers frequently handle powerful API keys and cloud credentials in their local development environments. The package was active on PyPI for approximately 9 days before being reported and removed by the PyPI security team. It is estimated to have been downloaded over 3,000 times, potentially compromising numerous developer machines and cloud infrastructure accounts. This incident highlights the ongoing threat of typosquatting in open-source registries and the need for stringent dependency management.
Affected Systems
Testing Guide
1. **Check Installation History**: Run the command `pip list | grep huggingface-tranformers` in your Python environments. The presence of this package (with one 's') indicates you are affected. 2. **Review Shell History**: Check your shell history (e.g., `~/.bash_history`) for installation commands like `pip install huggingface-tranformers`. 3. **Network Log Analysis**: Examine outbound network traffic from developer machines for suspicious connections to unknown domains around the time of package installation.
Mitigation Steps
1. **Check Dependencies**: Immediately audit your project's `requirements.txt`, `pyproject.toml`, or other dependency files for the presence of `huggingface-tranformers` (with one 's'). 2. **Remove the Package**: If found, uninstall the package immediately using `pip uninstall huggingface-tranformers`. 3. **Rotate All Credentials**: Assume any credentials on the affected machine have been compromised. Immediately rotate all AWS IAM keys, OpenAI API keys, GitHub tokens, and other secrets found in environment variables or configuration files. 4. **Use Lockfiles**: Enforce the use of lockfiles (e.g., `poetry.lock`, `pipfile.lock`, `requirements.txt` with hashed versions) to ensure deterministic and verified builds. 5. **Automated Scanning**: Integrate automated security scanning tools like `pip-audit` or Snyk into your CI/CD pipeline to detect malicious or vulnerable packages.
Patch Details
The malicious package was removed from the PyPI registry on 2026-06-16.