Malicious PyPI packages 'torch-optimizer' and 'vision-tools' exfiltrate AWS credentials from AI developer environments
Overview
Security researchers at Phylum discovered two malicious packages, `torch-optimizer` and `vision-tools`, on the Python Package Index (PyPI). These packages employed typosquatting, targeting developers who might misspell popular ML libraries. Upon installation via `pip`, a malicious `setup.py` script was executed. This script contained a payload designed to scan the local machine for sensitive credentials commonly used in AI development workflows. Specifically, it searched for the `~/.aws/credentials` file and environment variables such as `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`. If credentials were found, they were base64 encoded and exfiltrated via an HTTP POST request to a remote command-and-control (C2) server. This attack poses a critical risk as compromised AWS credentials could grant attackers access to sensitive datasets in S3, allow them to manipulate or poison training data, or misuse expensive GPU instances for unauthorized activities like cryptocurrency mining, leading to significant financial and data breach impacts. The incident highlights the growing threat of supply chain attacks targeting the AI/ML ecosystem, where developers frequently handle high-value cloud credentials directly on their workstations.
Affected Systems
Testing Guide
1. Check your project's dependencies and global pip packages for `torch-optimizer` or `vision-tools` by running `pip list`. 2. Review shell history for `pip install` commands related to these packages. 3. Examine network logs for outbound HTTP POST requests to unknown domains originating from Python processes around the time of installation.
Mitigation Steps
1. Immediately uninstall the malicious packages: `pip uninstall torch-optimizer vision-tools`. 2. Scan your system for indicators of compromise, including suspicious network connections from Python processes. 3. Rotate all AWS IAM credentials, API keys, and any other secrets stored on the affected development machine. 4. Implement a dependency scanning tool like `pip-audit` or commercial equivalents in your CI/CD pipeline. 5. Use a `requirements.txt` file with pinned, hashed versions (`pip freeze > requirements.txt`) to prevent accidental installation of malicious packages.
Patch Details
The malicious packages were removed from the PyPI registry by the PyPI security team. No patch exists; systems must be remediated by removing the packages and rotating compromised credentials.