Malicious PyPI Package 'torch-serve' Steals Cloud Credentials and API Keys
Overview
A malicious supply chain attack was identified targeting AI and Machine Learning developers through the Python Package Index (PyPI). A package named `torch-serve`, typosquatting the legitimate `torchserve` package, was uploaded by an unknown threat actor. The malicious package included a harmful `setup.py` script that executed upon installation via `pip install torch-serve`. The script contained obfuscated Python code that performed reconnaissance on the developer's machine. It specifically searched for sensitive information in common locations, including AWS credentials in `~/.aws/credentials`, GCP and Azure configuration files, SSH private keys in `~/.ssh/`, and environment variables containing API keys (e.g., `OPENAI_API_KEY`, `HUGGING_FACE_TOKEN`, `ANTHROPIC_API_KEY`). Upon finding credentials, the script would Base64 encode them and exfiltrate the data via a DNS request or an HTTP POST to an attacker-controlled endpoint. This attack highlights the significant risk of typosquatting in the AI development ecosystem, where developers frequently install numerous open-source packages, potentially leading to compromised production environments and stolen proprietary data.
Affected Systems
Testing Guide
1. Review your project's dependencies and your global pip packages for `torch-serve` by running `pip list`. 2. Check shell history for `pip install torch-serve`. 3. If the package was installed, immediately revoke all potentially compromised credentials (API keys, cloud IAM roles, SSH keys) and inspect outbound network traffic for suspicious activity.
Mitigation Steps
1. **Vet Dependencies:** Use tools like `pip-audit` or commercial dependency scanners to check for known malicious packages before installation. 2. **Use Virtual Environments:** Isolate project dependencies using virtual environments (`venv`, `conda`) to limit the potential blast radius of a malicious package. 3. **Lock Dependencies:** Use `requirements.txt` or `poetry.lock` files with pinned, hashed versions to ensure repeatable and verified builds. 4. **Credential Management:** Avoid storing secrets in plaintext files or environment variables. Use a dedicated secrets manager like AWS Secrets Manager, GCP Secret Manager, or HashiCorp Vault.
Patch Details
The malicious package was removed from PyPI by the platform's security team. No patch is available; systems must be manually cleaned and credentials rotated.