Malicious PyPI Package `tensor-monitor` Steals Cloud Credentials and Model Weights
Overview
A malicious package named `tensor-monitor` was discovered on the Python Package Index (PyPI) masquerading as a utility for monitoring GPU memory usage during model training. The package contained obfuscated code within its `setup.py` file that executed upon installation via `pip install`. This malicious payload was designed to scan the local environment for common cloud credential files (e.g., `~/.aws/credentials`, `~/.gcp/application_default_credentials.json`) and environment variables prefixed with `AWS_`, `GCP_`, or `AZURE_`. Upon finding credentials, it would exfiltrate them to a remote command-and-control (C2) server. Additionally, a secondary payload would recursively scan the user's home directory for common model file extensions such as `.pth`, `.safetensors`, and `.h5`, uploading any discovered proprietary models. The package gained over 5,000 downloads through typosquatting, using a name similar to legitimate monitoring tools and being promoted in online forums. The incident highlights the growing threat of supply chain attacks targeting the AI/ML ecosystem, where high-value assets like cloud API keys and trained models are prime targets for industrial espionage and theft. The attack was discovered by a security firm that detected anomalous network traffic from one of its sandboxed build servers during a routine dependency audit. PyPI administrators have since removed the malicious package.
Affected Systems
Testing Guide
1. Check your installed Python packages by running `pip list | grep tensor-monitor` in your virtual environments and system Python. 2. Search your project's dependency files (e.g., `requirements.txt`, `pyproject.toml`) for the string `tensor-monitor`. 3. Review shell history for `pip install tensor-monitor` commands. 4. Monitor outbound network traffic from developer workstations and build servers for connections to unknown or suspicious endpoints, especially after new package installations.
Mitigation Steps
1. **Immediately remove the package**: Run `pip uninstall tensor-monitor` and verify it has been removed from all environments. 2. **Scan for presence**: Check project `requirements.txt` files and build logs for any mention of `tensor-monitor`. 3. **Rotate credentials**: Immediately rotate all cloud provider API keys, service account credentials, and any other secrets present on machines where the package may have been installed. 4. **Audit systems**: Perform a forensic analysis of affected systems to check for persistence mechanisms or further compromise. 5. **Use dependency scanning**: Implement automated dependency scanning tools like `pip-audit` or commercial solutions in your CI/CD pipeline to vet packages against known vulnerabilities and malicious package databases.
Patch Details
The package was removed from the PyPI registry. There is no 'patched' version; the package should be completely uninstalled.