Malicious PyPI Package 'torch-utils-extra' Steals Hugging Face and AWS Credentials
Overview
A malicious package named `torch-utils-extra` was discovered on the Python Package Index (PyPI). The package was typosquatted to resemble a legitimate, albeit non-existent, utility library for PyTorch users. The package's setup.py file contained obfuscated code that executed upon installation (`pip install torch-utils-extra`). This malicious code would scan the user's home directory for common locations of developer credentials, specifically targeting `~/.huggingface/token` for Hugging Face API tokens and `~/.aws/credentials` for AWS access keys. Once found, these credentials were exfiltrated via a DNS tunnel to an attacker-controlled server. This attack specifically targets AI/ML developers and data scientists who frequently handle sensitive models and data stored in Hugging Face Hub and AWS S3. The impact is high, as stolen credentials can lead to unauthorized access to private models, training data, and cloud infrastructure, resulting in significant financial loss, intellectual property theft, and reputational damage. The package was discovered by the PyPI security team after automated systems flagged its anomalous network activity. It was downloaded over 2,500 times before being removed.
Affected Systems
Testing Guide
1. Check your project's dependencies or pip history for the presence of `torch-utils-extra`. Run `pip list | grep torch-utils-extra`. 2. If the package is or was installed, assume compromise. 3. Monitor outbound DNS requests from development machines for unusual patterns immediately after package installations.
Mitigation Steps
1. Immediately uninstall the package: `pip uninstall torch-utils-extra`. 2. Rotate all Hugging Face API tokens and AWS IAM credentials that were present on the affected machine. 3. Scan the affected system for any residual malware or backdoors. 4. Use tools like `pip-audit` or Snyk to scan project dependencies for known malicious packages. 5. Adopt a policy of using version pinning and hash-checking for all dependencies using files like `requirements.txt` or `poetry.lock`.
Patch Details
The malicious package was removed from the PyPI registry by the security team.