Malicious PyPI Packages `tensorfl0w-gpu` and `hugingface-cli` Steal Developer Credentials
Overview
A supply chain attack was identified where malicious packages were uploaded to the Python Package Index (PyPI) targeting AI and machine learning developers. The packages, named `tensorfl0w-gpu` and `hugingface-cli`, used typosquatting to impersonate the popular `tensorflow-gpu` and `huggingface-hub` libraries. The attack relied on developers making small typographical errors during `pip install`. Once installed, the packages' `setup.py` script would execute a malicious payload. This payload was designed to scan the developer's machine for sensitive information, specifically targeting common locations for environment variable files (`.env`), AWS credentials (`~/.aws/credentials`), GCP and Azure configuration files, and SSH keys (`~/.ssh/`). The stolen data, including API keys for services like OpenAI, Anthropic, and cloud providers, was then exfiltrated to an attacker-controlled command-and-control (C2) server via a DNS tunnel to avoid detection by network firewalls. This incident highlights the ongoing risk of supply chain attacks in the rapidly growing AI development ecosystem, where developers frequently install numerous third-party packages. The PyPI security team has since removed the malicious packages.
Affected Systems
Testing Guide
1. Do NOT install the malicious packages. 2. Review your project's `requirements.txt` or `pyproject.toml` files for any suspicious or misspelled package names. 3. Check your shell history (`history | grep "pip install"`) for potential typos in past installation commands. 4. Scan your project's dependencies using a security scanner: `pip-audit`.
Mitigation Steps
1. Carefully verify package names before installation. Use copy-paste from official documentation rather than typing manually. 2. Use tools like `pip-audit` or Snyk to scan dependencies for known vulnerabilities and malicious packages. 3. Run development environments in sandboxed or containerized environments with limited network access and permissions. 4. Avoid storing secrets in plaintext files. Use a dedicated secrets management solution like HashiCorp Vault or cloud provider services (e.g., AWS Secrets Manager). 5. Regularly rotate API keys and credentials.
Patch Details
The malicious packages have been removed from the PyPI registry by the PyPI security team.