Malicious PyPI Package 'torch-utils' Steals Cloud Credentials and Model Weights
Overview
A sophisticated supply chain attack was identified targeting AI/ML developers through a malicious package named `torch-utils` published on the Python Package Index (PyPI). The package, which mimicked the naming convention of legitimate PyTorch ecosystem libraries, contained malicious code hidden within its `setup.py` and `__init__.py` files. Upon installation (`pip install torch-utils`), the `setup.py` script would execute a preliminary payload that established persistence. When the package was later imported in a Python script (`import torch_utils`), the `__init__.py` module would activate. This module was designed to scan the local environment for sensitive information critical to AI development workflows. It searched for environment variables, dotfiles (`.aws/credentials`, `.gcloud/`), and Kubernetes configuration files to harvest cloud provider credentials. Furthermore, the malware specifically searched for files with extensions like `.pt`, `.pth`, `.safetensors`, and `.onnx`, exfiltrating proprietary trained model weights to an attacker-controlled server. This attack highlights the growing threat of supply chain attacks that are highly tailored to the AI development lifecycle, aiming to steal not just credentials but also valuable intellectual property in the form of trained models.
Affected Systems
Testing Guide
1. In your Python environment, run the command `pip list | grep torch-utils`. 2. If the package `torch-utils` is present, your system is affected. 3. Check your shell history (`history | grep 'pip install torch-utils'`) to see if the package was installed in the past. 4. Inspect network logs for any suspicious outbound connections to unknown IP addresses or domains from machines used for AI development, particularly POST requests with large payloads.
Mitigation Steps
1. Immediately run `pip uninstall torch-utils` and check your project's `requirements.txt` or `pyproject.toml` files to ensure it is not a dependency. 2. Use tools like `pip-audit` or `safety` to scan your environment's dependencies against known vulnerability databases. 3. Pin your dependencies to specific, trusted versions in production environments (e.g., `torch==2.5.1`). 4. For critical projects, consider vetting new or less-known third-party libraries by inspecting their source code before integration. 5. Rotate all cloud credentials (AWS, GCP, Azure) and SSH keys found on any system where the package may have been installed.
Patch Details
The malicious package `torch-utils` was removed from the PyPI registry by the PyPA security team on 2026-05-29.