Malicious PyPI Package 'torch-utils-nightly' Steals Cloud Credentials from AI Developer Environments
Overview
A malicious package named `torch-utils-nightly` was discovered on the Python Package Index (PyPI). The package engaged in typosquatting, targeting developers who might misspell `torch.utils` or search for nightly builds of PyTorch utilities. Upon installation via `pip install`, the package's `setup.py` script executed a malicious payload. This payload was specifically designed to compromise AI/ML development environments. It would scan the user's home directory for common credential files, including `~/.aws/credentials`, `~/.gcp/application_default_credentials.json`, and environment variables related to cloud providers like AWS, GCP, and Azure. Furthermore, it specifically searched for Hugging Face and Weights & Biases API tokens (`~/.cache/huggingface/token`, `~/.netrc`). Once found, these credentials and tokens were base64 encoded and exfiltrated to a command-and-control (C2) server via a DNS tunnel to avoid detection by network firewalls. The impact is critical, as stolen credentials provide attackers with direct access to cloud infrastructure, potentially allowing them to steal proprietary models, poison training data, or run expensive GPU instances for malicious purposes like cryptocurrency mining. The PyPI security team has since removed the package, but anyone who installed it is presumed compromised.
Affected Systems
Testing Guide
1. Check your installed packages by running `pip list | grep torch-utils-nightly` in your virtual environments. 2. Search your shell history for `pip install torch-utils-nightly`. 3. Review your local file system and CI/CD build logs for any mention of the package name. 4. Monitor outbound DNS traffic from development machines and build servers for anomalous queries, which could indicate data exfiltration.
Mitigation Steps
1. Immediately run `pip uninstall torch-utils-nightly` in all relevant Python environments. 2. Audit all `requirements.txt`, `pyproject.toml`, and other dependency files to ensure this package is not listed. 3. Rotate all cloud credentials (AWS, GCP, Azure), Hugging Face tokens, and any other secrets stored in the compromised environments. 4. Use tools like `pip-audit` or Snyk to scan dependencies for known malicious packages before installation. 5. Enforce policies that require package versions to be pinned and their hashes checked during CI/CD builds.
Patch Details
The malicious package 'torch-utils-nightly' was removed from the PyPI registry on 2026-06-26.