Malicious PyPI Packages `torch-utils` and `huggingface-cli` Steal API Keys and Model Data
Overview
Security researchers uncovered a sophisticated supply chain attack targeting AI developers via typosquatted packages on the Python Package Index (PyPI). The packages, named `torch-utils` and `huggingface-cli`, were designed to impersonate legitimate utility libraries for PyTorch and Hugging Face Transformers. Upon installation via `pip`, the package's `setup.py` script would execute a malicious payload. This payload profiled the developer's environment by scanning for common environment variables and configuration files associated with cloud providers (AWS, GCP, Azure), AI platforms (OpenAI, Anthropic, Hugging Face Hub), and database services. It then exfiltrated any discovered API keys, access tokens, and secrets to a remote command-and-control (C2) server. In a more advanced step, the payload would use function hooking to intercept calls to `torch.save()` and `model.save_pretrained()`. This allowed it to covertly upload copies of trained model weights and proprietary checkpoints to an attacker-controlled S3 bucket. This dual-threat capability enabled attackers to steal not only credentials for immediate financial gain but also valuable intellectual property in the form of custom-trained models. The packages were downloaded over 5,000 times before being identified by the PyPI security team and removed.
Affected Systems
Testing Guide
1. **Check Installed Packages**: Run `pip freeze | grep -E 'torch-utils|huggingface-cli'` to see if the malicious packages are installed in your current environment. 2. **Check Shell History**: Review your shell history (`history | grep pip`) for installation commands related to these packages. 3. **Monitor Outbound Network Traffic**: Check network logs for any suspicious outbound connections from developer machines or CI/CD runners to unknown IP addresses, especially after a new package installation.
Mitigation Steps
1. **Audit Dependencies**: Immediately audit your project's `requirements.txt` or `pyproject.toml` files for the presence of `torch-utils` or `huggingface-cli`. Remove them if found. 2. **Scan for Malicious Packages**: Use security scanners like `pip-audit` or Snyk to check for known malicious or vulnerable packages in your dependencies. 3. **Rotate Credentials**: If these packages were installed, assume all local credentials have been compromised. Immediately rotate all API keys, secrets, and access tokens for cloud and AI services. 4. **Vet New Packages**: Before installing a new package, verify its authenticity by checking its download statistics, release history, and associated GitHub repository on PyPI.
Patch Details
The malicious packages have been removed from PyPI. The vulnerability exists in developer environments that installed them.