Malicious PyPI Packages `torch-sampler` and `huggingface-cli` Exfiltrate AWS and Hugging Face Credentials
Overview
A supply chain attack was identified involving two malicious packages, `torch-sampler` and `huggingface-cli`, uploaded to the Python Package Index (PyPI). These packages were designed to typosquat popular libraries used by AI and machine learning developers. The attack was triggered upon installation via `pip install`. The `setup.py` file in these packages contained obfuscated code that executed a malicious payload. This payload scanned the user's home directory for sensitive credentials, specifically targeting the `~/.aws/credentials` file for AWS keys and the `~/.cache/huggingface/token` file for Hugging Face Hub API tokens. Upon finding these files, the script would Base64 encode their contents and exfiltrate them via a POST request to a remote command-and-control (C2) server. This provided the attackers with direct access to the victims' AWS infrastructure, allowing them to provision resources or access sensitive data, and to their private models and datasets on the Hugging Face Hub. The attack highlights the significant supply chain risk for AI developers, whose environments are rich targets for credential theft due to their frequent interaction with cloud services and model repositories.
Affected Systems
Testing Guide
1. **Check Installed Packages**: Run `pip freeze | grep -E "torch-sampler|huggingface-cli"` in your virtual environments to see if the malicious packages are installed. 2. **Review Shell History**: Check your shell history (e.g., `~/.bash_history`) for installation commands related to these packages. 3. **Inspect Network Logs**: If possible, inspect outbound network traffic from developer machines or CI/CD runners for suspicious POST requests to unknown domains shortly after a `pip install` command was run.
Mitigation Steps
1. **Audit Dependencies**: Regularly scan project dependencies for known malicious packages using tools like `pip-audit` or commercial software composition analysis (SCA) solutions. 2. **Use Pinned Versions**: Pin package versions in `requirements.txt` or `pyproject.toml` files to prevent accidental installation of newly published malicious packages. 3. **Use a Private Registry**: For enterprise environments, consider using a private package registry like Artifactory or Nexus that proxies PyPI and allows for vetting and caching of approved packages. 4. **Principle of Least Privilege**: Use temporary, short-lived credentials (e.g., IAM roles for EC2 instances, OIDC) instead of storing long-lived static keys in developer home directories. 5. **Remove Malicious Packages**: If either package was installed, immediately run `pip uninstall torch-sampler huggingface-cli`, rotate all AWS and Hugging Face credentials, and investigate for signs of compromise.
Patch Details
The malicious packages were removed from PyPI by the security team. There is no 'patch' other than removing the packages from affected systems.