Malicious PyPI Package 'torch-utils' Steals Hugging Face API Tokens and Credentials
Overview
A malicious package named 'torch-utils' was discovered on the Python Package Index (PyPI), targeting AI and machine learning developers. The package, a typosquat of the legitimate and popular 'torch' library, contained malicious code within its `setup.py` file. Upon installation via `pip install torch-utils`, the script would execute a payload that scanned the user's home directory for sensitive credentials commonly used in AI development. Specifically, it searched for the Hugging Face API token located at `~/.huggingface/token`, SSH private keys in `~/.ssh/`, and AWS credentials in `~/.aws/credentials`. If found, these files were compressed and exfiltrated via a DNS tunnel to an attacker-controlled server. This attack highlights the significant supply chain risk for the AI ecosystem, where developers frequently install numerous open-source packages. The impact is critical, as a stolen Hugging Face token could grant the attacker access to private models and datasets, while stolen cloud or SSH credentials could lead to a complete system or infrastructure compromise. The package was reported to the PyPI security team and promptly removed.
Affected Systems
Testing Guide
1. Run `pip list | grep torch-utils` in your terminal for each of your Python environments. 2. If the package is found, your system should be considered compromised. 3. Check your shell history (`history | grep 'pip install torch-utils'`) to see if the package was installed in the past. 4. Review outbound network logs for unusual DNS requests around the time of installation, which could indicate data exfiltration.
Mitigation Steps
1. Immediately check your installed packages for `torch-utils` by running `pip list` and uninstall it if present using `pip uninstall torch-utils`. 2. If the package was installed, rotate all potentially compromised credentials, including Hugging Face API tokens, AWS IAM credentials, and SSH keys. 3. Implement a PyPI proxy like `devpi` or use tools such as `pip-audit` in your CI/CD pipeline to scan for known malicious or vulnerable packages before installation. 4. Educate developers on the dangers of typosquatting and encourage careful verification of package names before installation.
Patch Details
The malicious package has been removed from the PyPI registry. No patch is required for pip itself, but users must remove the package from their systems.