Malicious PyPI Package `tensorfiow-lite` Steals Cloud Credentials from AI Developer Environments
Overview
A malicious Python package named `tensorfiow-lite` was discovered on the Python Package Index (PyPI), typosquatting the official `tensorflow-lite` library. The package mimicked the functionality of the legitimate library to avoid immediate detection but contained a malicious payload concealed within its `setup.py` and `__init__.py` files. Upon installation (`pip install tensorfiow-lite`), the package executed an obfuscated script that scanned the user's environment for sensitive information commonly used in AI development. This included environment variables such as `OPENAI_API_KEY`, `HUGGING_FACE_HUB_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and Google Cloud credentials files. The stolen credentials were then Base64-encoded and exfiltrated via a DNS tunnel or a direct HTTPS POST request to an attacker-controlled command-and-control (C2) server. This attack targeted AI/ML engineers and data scientists, who often store high-value credentials in their development environments. The compromised keys could be used to incur fraudulent charges on cloud services, steal proprietary datasets and trained models, or gain further access to corporate networks. The package was active for over two weeks and had several hundred downloads before being identified and removed by the PyPI security team.
Affected Systems
Testing Guide
1. **Check Installed Packages:** Run the command `pip list | grep tensorfiow-lite` in your Python environments. If it returns a result, you have the malicious package installed. 2. **Review Shell History:** Check your shell history (`history | grep 'pip install tensorfiow-lite'`) for installation commands. 3. **Inspect Dependency Trees:** Examine the `requirements.txt` or other dependency files in your projects for the misspelled package name (`tensorfiow` instead of `tensorflow`). 4. **Review Cloud Logs:** Audit cloud service logs (e.g., AWS CloudTrail, Azure Activity Log) for any unauthorized API calls originating from unknown IP addresses, which could indicate compromised credentials are being used.
Mitigation Steps
1. **Remove the Package:** Immediately run `pip uninstall tensorfiow-lite` in all relevant environments. 2. **Rotate All Credentials:** Assume any credentials accessible to the user environment have been compromised. This includes API keys for OpenAI, Hugging Face, Anthropic, AWS, GCP, Azure, and any other services stored in environment variables, `.env` files, or config files. 3. **Use Scanners:** Implement dependency scanning tools like `pip-audit` or commercial equivalents in your CI/CD pipeline to detect malicious or vulnerable packages. 4. **Enforce Version Pinning:** Use `requirements.txt` or `poetry.lock` files to pin dependencies to specific, vetted versions to prevent accidental installation of malicious packages.
Patch Details
The malicious package `tensorfiow-lite` was removed from the PyPI registry. Mitigation requires manual uninstallation and credential rotation by affected users.