Malicious PyTorch Lightning package made it onto PyPI, malware stole passwords and cloud keys

Attackers uploaded to the PyPI repository a malicious version of the popular framework PyTorch Lightning. The compromised package in version 2.6.3 contained malware referred to as ShaiWorm, which focused on stealing credentials, API keys and cloud tokens. Microsoft reported the incident.

PyPI is the largest repository of Python packages used by developers around the world. PyTorch Lightning serves as an extension of the PyTorch framework for training and deploying AI models.

After installation additional malicious code was downloaded in the background

According to Microsoft, after importing the package lightning==2.6.3 a hidden process ran that downloaded the tool Bun and then executed more than 11MB of heavily obfuscated JavaScript code.

The malicious version was published on PyPI as a universal Python package of type py3-none-any, which means it could run on various platforms without further modification.

The malware subsequently allowed attackers to execute arbitrary commands on the compromised device.

Malware stole passwords, tokens and contents of .env files

The malware known as ShaiWorm searched on infected systems for:

• .env files,
• API keys,
• GitHub tokens,
• and cloud access credentials.

According to available information it also targeted stored passwords in the Chrome, Firefox and Brave browsers.

The attackers also attempted to obtain access keys for cloud services:

• AWS,
• Microsoft Azure,
• and Google Cloud Platform.

Such data is particularly valuable to attackers because it can enable access to an organization's infrastructure, databases, or internal services.

Microsoft so far records a limited number of cases

Microsoft stated that the observed activity, based on current findings, was limited to a small number of devices and environments.

The Lightning AI team recommended that all users who used version 2.6.3 immediately change:

• passwords,
• API keys,
• tokens,
• and other sensitive access credentials.

According to the company, Microsoft Defender was able to detect the malicious package and the incident was subsequently reported to the PyPI administrators.

The exact number of affected organizations or devices has not yet been disclosed.

It's unclear how the malicious code got into the package

PyPI maintainers removed the malicious version at the end of April and Lightning AI subsequently published a safe release.

The investigation is ongoing and it has not yet been confirmed:

• how the attackers got into the release process,
• or whether other versions of the package were compromised.

Microsoft is also analyzing additional telemetry and indicators of compromise that could help determine the scope of the incident.

Source

• https://securityaffairs.com/191732/ai/malicious-pytorch-lightning-update-hits-ai-supply-chain-security.html