Malicious PyPI Package `tensorfiow-lite` Steals AWS Credentials and Model Checkpoints
Overview
Security researchers at Checkmarx identified a malicious package named `tensorfiow-lite` on the Python Package Index (PyPI), typosquatting the popular `tensorflow-lite` package. The malicious package replicated the legitimate package's functionality but included an obfuscated `setup.py` script that executed upon installation. This script searched the user's home directory for common credential files, specifically `~/.aws/credentials` and `~/.gs/credentials`, and exfiltrated them to a hardcoded command-and-control (C2) server. Furthermore, the malware would scan for files with common model checkpoint extensions like `.pth`, `.pt`, and `.safetensors`, uploading any discovered files under 100MB. This attack targets AI/ML developers who might accidentally install the misspelled package, leading to the immediate compromise of their cloud infrastructure and proprietary model weights. The package was downloaded over 1,500 times before being removed by the PyPI security team.
Affected Systems
Testing Guide
1. Run the command `pip freeze | grep tensorfiow-lite` in your development environments. 2. Check shell history for `pip install tensorfiow-lite`. 3. Review `requirements.txt` and `pyproject.toml` files for the presence of the misspelled package.
Mitigation Steps
1. Immediately check project dependencies for the `tensorfiow-lite` package and remove it. 2. If the package was installed, rotate all AWS and GCP credentials immediately. 3. Audit systems for any signs of data exfiltration and review model checkpoints for potential tampering. 4. Use `pip-audit` or similar tools to scan dependencies for known malicious packages. 5. Enforce organizational policies to only use vetted packages from a private repository.
Patch Details
The malicious package was removed from PyPI. No patch is applicable; users must remove the package manually.