Malicious PyPI Package 'torch-utility-lite' Steals Cloud Credentials and API Keys
Overview
A malicious package named `torch-utility-lite` was discovered on the Python Package Index (PyPI), targeting AI and machine learning developers. The package employed typosquatting, using a name similar to legitimate PyTorch utilities to trick developers into installing it. Upon installation via `pip`, the package's `setup.py` script executed a malicious payload obfuscated within a seemingly harmless utility function. The payload was designed to exfiltrate sensitive credentials commonly found in AI development environments. It recursively scanned the user's home directory for files like `~/.aws/credentials`, `~/.gcp/credentials.json`, and `~/.ssh/id_rsa`. Additionally, it scanned shell history files and environment variables for patterns matching `OPENAI_API_KEY`, `HUGGING_FACE_HUB_TOKEN`, and `ANTHROPIC_API_KEY`. All discovered credentials were then base64-encoded and exfiltrated via a DNS query or an HTTP POST request to a remote command-and-control (C2) server. The primary goal of the attackers was to hijack high-value cloud accounts to provision GPU instances for cryptocurrency mining and to gain access to proprietary models and datasets. The package was active for several weeks and was downloaded over 1,500 times before being identified by automated scanning tools from Socket.dev and removed by PyPI administrators.
Affected Systems
Testing Guide
1. **Check Installed Packages**: Run `pip freeze` in your project environments and look for `torch-utility-lite` in the output. 2. **Search Filesystem**: Search your system for the package's installation directory to see if it exists (e.g., in `site-packages`). 3. **Review Network Logs**: Analyze DNS and HTTP logs from developer workstations for suspicious outbound connections around the time of package installations, looking for requests to unknown domains.
Mitigation Steps
1. **Credential Rotation**: Immediately rotate all API keys and credentials (AWS, GCP, OpenAI, SSH keys) on any machine where this package may have been installed. 2. **Dependency Scanning**: Integrate dependency scanning tools (e.g., Snyk, Dependabot, Socket) into your CI/CD pipeline to vet packages for known malware or suspicious behaviors. 3. **Use Virtual Environments**: Always use isolated virtual environments for projects to prevent a malicious package from accessing system-wide credentials. 4. **Review Dependencies**: Manually review package names for typos before installation and inspect packages with low download counts or recent creation dates.
Patch Details
The malicious package has been removed from the PyPI registry. This action prevents new installations but does not remove the package from systems where it is already installed.