Malicious PyPI Package `tensorfl0w-gpu` Steals Cloud and AI Service Credentials
Overview
A malicious Python package named `tensorfl0w-gpu` was discovered on the Python Package Index (PyPI), typosquatting the popular (but now deprecated) `tensorflow-gpu` package. The malicious package mimics the installation process of the legitimate library but includes a harmful payload concealed within its `setup.py` script. Upon installation via `pip install tensorfl0w-gpu`, the script executes a base64-encoded payload. This payload scans the user's environment for sensitive information, specifically targeting environment variables and configuration files commonly used by AI/ML developers. It searches for AWS credentials (in `~/.aws/credentials`), GCP and Azure authentication tokens, as well as API keys for services like OpenAI, Hugging Face, Anthropic, and Cohere. The stolen credentials are then exfiltrated to a hardcoded command-and-control (C2) server controlled by the attacker. This type of supply chain attack is particularly dangerous as it compromises the developer's machine and provides the attacker with high-privilege access to cloud infrastructure and expensive AI APIs, potentially leading to significant financial loss, data breaches, and model theft. The package was active on PyPI for over a week before being reported and removed by the PyPI security team.
Affected Systems
Testing Guide
1. Check your project's `requirements.txt` or `pyproject.toml` files for the exact package name `tensorfl0w-gpu` (with a zero). 2. Run `pip list | grep tensorfl0w-gpu` in all relevant Python virtual environments to see if the package is installed. 3. Review shell history (`history | grep 'pip install tensorfl0w-gpu'`) for installation commands. 4. Analyze network logs from developer machines for suspicious outbound traffic to unknown domains immediately following Python package installations.
Mitigation Steps
1. Immediately uninstall the package: `pip uninstall tensorfl0w-gpu`. 2. Rotate all potentially compromised credentials, including AWS, GCP, Azure, OpenAI, and Hugging Face keys. 3. Scan developer workstations and CI/CD environments for the presence of the package or indicators of compromise (e.g., outbound network connections to known malicious IPs). 4. Use tools like `pip-audit` or Snyk to scan dependencies for known malicious or vulnerable packages before installation. 5. Enforce organizational policies to only use vetted packages from a private repository or a curated allow-list.
Patch Details
The malicious package was removed from the PyPI registry on 2026-06-19.