Malicious PyPI Packages 'torch-utils' and 'cv2-plus' Steal AI Model Weights and Cloud Credentials
Overview
Security firm Checkmarx identified a new supply chain attack targeting AI and machine learning developers. The campaign involved two malicious packages, `torch-utils` and `cv2-plus`, uploaded to the Python Package Index (PyPI). These packages were typo-squatted to resemble legitimate, popular libraries (`torch` and `opencv-python`). The malicious packages contained sophisticated malware hidden within their `setup.py` scripts. Upon installation via `pip`, the malware would activate, scanning the developer's machine for common signs of an AI development environment. Specifically, it searched for files with extensions like `.pth`, `.pt`, `.safetensors`, and `.h5` to exfiltrate proprietary model weights. Furthermore, it scanned for environment variables and configuration files (`~/.aws/credentials`, `~/.gcloud/`) associated with AWS, Google Cloud, and Azure to steal cloud credentials. The stolen data was then compressed and exfiltrated to a command-and-control (C2) server hosted on a compromised domain. The attack's primary goal was industrial espionage, aiming to steal valuable intellectual property (trained models) and hijack cloud infrastructure used for large-scale training runs. The PyPI security team has since removed the packages, but not before they were downloaded over 5,000 times.
Affected Systems
Testing Guide
1. Run the command `pip freeze | grep -E 'torch-utils|cv2-plus'` in your project's virtual environment and system Python environment. 2. Check your shell history for installations of these packages. 3. Examine network logs for outbound connections to suspicious domains, especially shortly after any `pip install` operations were performed. 4. Scan developer workstations and build servers with endpoint detection and response (EDR) tools.
Mitigation Steps
1. Immediately check your project dependencies and global Python environment for the packages `torch-utils` or `cv2-plus`. If found, remove them and consider the environment compromised. 2. Run `pip list` and carefully audit all installed packages for potential typo-squatting. 3. If compromised, rotate all cloud credentials (AWS, GCP, Azure), API keys, and other secrets found on the affected machine. 4. Implement a dependency firewall or proxy that vets packages against known malware and only allows installation from a curated list of approved packages. 5. Use `pip install --no-deps` for initial installs and carefully vet transitive dependencies before allowing them.
Patch Details
The malicious packages were removed from the PyPI registry on December 5, 2025. There is no 'patch' other than removing the packages from affected systems.