Case aliyun-ai-labs-pypi-pickleAI supply chainChina
PyPI packages posing as Alibaba AI Labs SDK hide infostealer in PyTorch model
Packages aliyun-ai-labs-snippets-sdk, ai-labs-snippets-sdk and aliyun-ai-labs-sdk shipped a model.pt whose pickle payload collected host details and .gitconfig and sent them to an Alibaba Cloud OSS bucket; about 1,600 downloads.
HighAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- May 22, 2025
- Location
- China
- Target
- Developers using Alibaba Cloud AI Labs services
- Severity
- High
- Triggered by
- PyPI account 'ai-aliyun'
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Packages aliyun-ai-labs-snippets-sdk, ai-labs-snippets-sdk and aliyun-ai-labs-sdk shipped a model.pt whose pickle payload collected host details and .gitconfig and sent them to an Alibaba Cloud OSS bucket; about 1,600 downloads.
Impact: Roughly 1,600 downloads; victims' IP, username, system information and Git configuration were exfiltrated
Who triggered it
Actor: PyPI account 'ai-aliyun'
Attribution: Published by the PyPI user ai-aliyun imitating Alibaba's Aliyun brand; ReversingLabs noted checks for AliMeeting data suggesting developers in China were the targets
Motive: Developer identity and infrastructure reconnaissance, likely as a first stage for further intrusion
How it happened
Attack vector: Fake SDK packages on PyPI whose import loads a PyTorch pickle that decodes base64 Python and exfiltrates data to aksjdbajkb2jeblad.oss-cn-hongkong.aliyuncs.com
Root cause: Pickle-based model files execute code on load; package registries do not inspect embedded ML artefacts
Timeline
- Packages appear on PyPI and are available for less than 24 hours
- JFrog publishes analysis of the model-embedded payload
- ReversingLabs reports about 1,600 total downloads and the AliMeeting targeting
Response
Packages removed from PyPI; JFrog, ReversingLabs and OpenSSF published malicious-package records and indicators
Current status: Resolved
Sources (open in a new tab)
- JFrog Security Research research.jfrog.com
- Hackread hackread.com
- OSV MAL-2025-5096 osv.dev
Cite this case
PyPI packages posing as Alibaba AI Labs SDK hide infostealer in PyTorch model. AI Threat Watch, case aliyun-ai-labs-pypi-pickle, May 22, 2025. https://aithreat.io/cases/aliyun-ai-labs-pypi-pickle/
Permanent link: https://aithreat.io/cases/aliyun-ai-labs-pypi-pickle/