Malicious PyPI Package 'torch-vison' Steals AI/ML Developer Credentials
Overview
A sophisticated supply chain attack was identified involving a malicious package named 'torch-vison' published to the Python Package Index (PyPI). This package typosquats the popular 'torchvision' library, a key component of the PyTorch ecosystem. The attacker's package contained a malicious `setup.py` file with obfuscated code that executed upon installation via `pip install torch-vison`. The payload was specifically designed to target AI and machine learning developers by scanning the system for sensitive credentials. It searched for common configuration file locations such as `~/.aws/credentials`, `~/.gcp/credentials.json`, and `~/.docker/config.json`. Furthermore, it iterated through shell history files (`.bash_history`, `.zsh_history`) and environment variables, looking for patterns matching API keys from services like OpenAI (`sk-...`), Hugging Face (`hf_...`), Anthropic, and various cloud providers. Once discovered, the credentials were base64 encoded and exfiltrated via DNS tunneling to a command-and-control server to evade network firewalls. The attack highlights the growing risk of targeted supply chain attacks against the AI developer community, who often handle high-value API keys and cloud access credentials in their local development environments.
Affected Systems
Testing Guide
1. Run the command `pip list` in your virtual and global Python environments. 2. Search the output for the package name `torch-vison`. The legitimate package is `torchvision`. 3. If `torch-vison` is found, your system is affected. 4. Check network logs for suspicious DNS queries to unknown domains, which could indicate data exfiltration.
Mitigation Steps
1. Immediately check your environment for the malicious package using `pip list | grep torch-vison` and uninstall it if present. 2. Do not install packages from PyPI without verifying the package name's spelling and its publisher. 3. Use `pip install --no-deps` for initial inspection if a package is suspicious, to avoid pulling in other malicious dependencies. 4. Rotate all API keys and cloud credentials found on any developer machine where this package might have been installed. 5. Implement a local PyPI proxy like `devpi` or use services like Snyk or Socket.dev to vet packages before they are introduced into your environment.
Patch Details
The malicious package was removed from PyPI by the security team on 2026-07-11. There is no 'patch' other than ensuring you are using the legitimate 'torchvision' package.