Malicious PyPI Package 'llm-caching-utils' Steals Cloud Credentials and SSH Keys
Overview
A malicious package named 'llm-caching-utils' was discovered on the Python Package Index (PyPI). The package was typosquatted to resemble a legitimate, albeit non-existent, utility for caching LLM requests. Upon installation via `pip install`, the package's `setup.py` script executes a malicious payload. This payload is obfuscated using Base64 and zlib compression. Once decoded, the script scans the user's home directory for sensitive files, specifically targeting `~/.aws/credentials`, `~/.gcp/`, `~/.azure/`, and `~/.ssh/`. It also harvests environment variables prefixed with 'AWS_', 'GCP_', 'AZURE_', and 'OPENAI_'. The stolen data is then exfiltrated via a DNS tunnel, with chunks of data encoded as subdomains of a malicious domain controlled by the attacker. This method is designed to bypass common network egress firewalls that may block direct HTTP/S POST requests to unknown domains but often permit DNS traffic. The campaign primarily targeted AI/ML developers and data scientists, who frequently handle sensitive cloud credentials on their development machines. The package was downloaded approximately 2,500 times before being removed by the PyPI security team.
Affected Systems
Testing Guide
1. Check your installed Python packages for 'llm-caching-utils' by running `pip freeze | grep llm-caching-utils`. 2. Examine your `requirements.txt` or `pyproject.toml` files for any references to this package. 3. Monitor outbound DNS queries from developer machines and CI runners for unusual, long subdomains, which may indicate DNS tunneling activity.
Mitigation Steps
1. Immediately run `pip uninstall llm-caching-utils` on all development and production environments. 2. Review shell history and CI/CD logs for installations of this package. 3. Rotate all credentials found in `~/.aws/`, `~/.gcp/`, and `~/.azure/` directories for any user or system that may have installed the package. 4. Revoke and reissue all SSH keys stored in the `~/.ssh/` directory. 5. Implement a software bill of materials (SBOM) and use tools like `pip-audit` to scan for known malicious or vulnerable packages before installation.
Patch Details
The malicious package has been removed from the PyPI registry. There is no legitimate version to upgrade to.