Malicious PyPI Packages Typosquatting ML Libraries Steal Developer Credentials
Overview
A widespread supply chain attack was identified by security firm Phylum, targeting AI and ML developers. A threat actor published over 50 packages to the Python Package Index (PyPI) using names that were common misspellings or variations of popular libraries such as `huggingface-hub`, `scikit-learn`, `tensorflow-gpu`, and `pytorch-lightning`. Examples included `huggingface_hub` (using an underscore), `scikit-leam`, and `tensor-flow-gpu`. The malicious packages contained hostile code within their `setup.py` files. Upon installation via `pip install`, this code would execute, harvesting sensitive information from the developer's environment. The malware specifically searched for and exfiltrated environment variables, dotfiles (`.aws/credentials`, `.git-credentials`), and SSH private keys. The stolen data was then base64 encoded and sent to a command-and-control (C2) server controlled by the attacker. This attack highlights the persistent risk of typosquatting in open-source registries and the significant danger it poses to organizations, as a single compromised developer machine can lead to a full-scale breach of cloud infrastructure and private code repositories.
Affected Systems
Testing Guide
1. Review your project's `requirements.txt` file and your shell history for any of the known malicious package names or close misspellings of common ML libraries. 2. Use a tool like `pip-audit` to scan your current Python environment for known vulnerabilities: `pip install pip-audit && pip-audit`. 3. Manually inspect the `setup.py` file of any suspicious or newly added dependency for obfuscated code or network requests to unknown domains before installing it.
Mitigation Steps
1. Use `pip` with a requirements file (`requirements.txt`) that has been vetted and locked with specific versions and hashes (`pip-tools`). 2. Before installing a package, verify its name and authenticity on the official PyPI website. Check for signs of illegitimacy like a recent creation date, low download count, or a suspicious author. 3. Integrate security scanners like `pip-audit` or commercial tools (Snyk, Checkmarx) into your CI/CD pipeline to automatically check for known malicious packages. 4. Educate developers on the risks of typosquatting and encourage copy-pasting install commands directly from official documentation.
Patch Details
The malicious packages were removed from PyPI by the registry's security team. However, new packages may appear at any time. The patch is vigilance and process control.