Xinference PyPI Poisoned: Steals Cloud Credentials

🔑 Enhanced Key Takeaways

• •The malicious payload utilized a multi-stage execution strategy, where the initial obfuscated Base64 string in init.py acted as a downloader for a secondary, more complex payload hosted on the C2 server to evade static analysis detection.
• •Security researchers identified that the compromised contributor account had been inactive for several months prior to the malicious commits, suggesting a credential stuffing or session hijacking attack against the maintainer's PyPI account.
• •The incident triggered a broader audit of the Xinference dependency tree, revealing that while the core framework remained secure, the supply chain attack specifically targeted the package distribution pipeline rather than the source code repository.

🛠️ Technical Deep Dive

• •The malicious script utilized the 'os' and 'subprocess' modules to traverse common configuration directories including ~/.aws/, ~/.kube/, and ~/.ssh/.
• •Data exfiltration was performed via HTTP POST requests to the C2 server, with the payload encrypted using a hardcoded XOR key to bypass basic network traffic inspection.
• •The script specifically targeted environment variables prefixed with 'AWS_', 'GCP_', 'OPENAI_', and 'DATABASE_' to capture credentials injected into the runtime environment.
• •Persistence was attempted by modifying shell profile files (.bashrc, .zshrc) to ensure the malicious code executed upon every terminal session initialization.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline