Malicious PyPI Package `torch-visoin` Steals AI Developer Credentials and API Keys
Overview
Security researchers at Phylum have identified a critical supply chain attack targeting AI and machine learning developers. A malicious package named `torch-visoin` was uploaded to the Python Package Index (PyPI), typosquatting the popular `torchvision` library. The malicious package contained a payload hidden within its `setup.py` and `__init__.py` files. Upon installation via `pip install torch-visoin`, the code executes on the developer's machine, scanning all environment variables for patterns matching common API keys and secrets. This includes keys for OpenAI (`OPENAI_API_KEY`), Hugging Face (`HF_TOKEN`), Anthropic (`ANTHROPIC_API_KEY`), AWS (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), and other sensitive credentials. The stolen keys are then exfiltrated to an attacker-controlled server using DNS tunneling, where the data is Base64 encoded and sent as a series of DNS queries for a specific domain. This method is often used to bypass egress firewalls that may block direct HTTP/S traffic but permit DNS resolution. The package was downloaded over 800 times before it was identified and removed by the PyPI security team. This incident highlights the ongoing risk of typosquatting in open-source registries and the importance of dependency hygiene for developers in the AI space, who often handle high-value credentials.
Affected Systems
Testing Guide
1. Run the command `pip list | grep torch-visoin` in your Python environments to check if the malicious package is installed. 2. Search your project's `requirements.txt` or other dependency files for the string `torch-visoin`. 3. Monitor outbound DNS traffic from developer workstations and build servers for unusual patterns or queries to unknown domains, which could indicate data exfiltration.
Mitigation Steps
1. Immediately audit all development and production environments for the presence of the `torch-visoin` package using `pip list`. 2. If found, remove the package, revoke all potentially compromised credentials (API keys, secrets), and inspect the system for persistence mechanisms. 3. Implement stricter dependency management by using lock files (`requirements.txt`, `poetry.lock`) and hash-checking with `pip install --require-hashes`. 4. Use tools like `pip-audit` in CI/CD pipelines to automatically scan for known malicious packages. 5. Educate developers on the dangers of typosquatting and the importance of verifying package names before installation.
Patch Details
The malicious package `torch-visoin` has been removed from the PyPI registry. No patch is available as this is not a vulnerability in a legitimate package. Remediation involves removing the malicious package and securing potentially compromised accounts.