Malicious PyPI Package `tensorfiow-addons` Exfiltrates Cloud Credentials
Overview
A malicious package named `tensorfiow-addons` was discovered on the Python Package Index (PyPI). This package typosquatted the popular and legitimate `tensorflow-addons` library, which was officially deprecated but remains a common dependency in older projects. The malicious package mimicked the structure of the real library but included an obfuscated payload in its `setup.py` file. Upon installation via `pip install tensorfiow-addons`, the script would execute. The payload was designed to scan the user's environment for common environment variables and configuration files associated with cloud service providers, specifically searching for `~/.aws/credentials`, `~/.gcp/credentials.json`, and environment variables like `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `OPENAI_API_KEY`. If found, the credentials were base64 encoded and exfiltrated via a DNS tunnel to a C2 server controlled by the attacker, a technique used to bypass egress firewalls. This supply chain attack targets AI/ML developers and automated CI/CD pipelines, which often have highly privileged credentials stored in their environments. The package was reported by the security firm Phylum and was quickly removed by the PyPI security team, but not before it registered several thousand downloads.
Affected Systems
Testing Guide
1. In your development or CI environment, execute `pip list | grep tensorfiow-addons` to check if the malicious package is installed. 2. Check shell history (`history | grep 'pip install tensorfiow-addons'`) for installation commands. 3. Examine network logs from the time of installation for unusual DNS requests to unknown domains, which could indicate data exfiltration.
Mitigation Steps
1. Immediately run `pip uninstall tensorfiow-addons` in any environment where it might have been installed. 2. Audit your project's `requirements.txt`, `pyproject.toml`, or other dependency files for this specific misspelling. 3. If the package was installed, assume all environment variables, secrets, and local credentials files have been compromised. Immediately rotate all API keys, IAM roles, and cloud credentials found in the affected environment. 4. Use tools like `pip-audit` or Snyk to scan dependencies for known malicious packages and vulnerabilities. 5. Configure CI/CD pipelines to use a private, vetted package repository or a proxy that caches and scans approved packages from PyPI.
Patch Details
The malicious package was removed from the PyPI registry. Mitigation requires user action to remove the package and rotate credentials.