A malicious PyPI package named aliyun-ai-labs-sdk v1.0.0 was published on May 20, 2025, impersonating an Alibaba AI Labs SDK to target machine learning developers. Armando's analysis found that the package bundles a fake PyTorch model file and calls torch.load with the unsafe weights_only=False flag, a technique that allows arbitrary Python code embedded in serialized model files to execute automatically at import time. The package was removed from PyPI after 227 downloads and has been confirmed malicious by Spectra Assure Community.
Key Findings
- Malicious version: v1.0.0, published 2025-05-20; no clean version exists
- Entry point: install lifecycle hook fires automatically during pip install via setup.py
- Targets: Python developers and ML engineering teams -- arbitrary code execution at import time via PyTorch pickle deserialization
- Evasion: warnings.filterwarnings("ignore") suppresses PyTorch's deserialization security warnings to hide the attack
- Detection: Text.Trojan.SupplyChain, Text.PUA.SupplyChain, Archive-GZIP.PUA.SupplyChain
Package Background
aliyun-ai-labs-sdk presents itself as an "AI Labs SDK for Python" targeting developers working with Alibaba's Aliyun cloud AI services. The publisher email address -- ai-labs@alilaba-inc.com -- deliberately misspells "alibaba" as "alilaba", a classic brand impersonation tactic designed to pass a cursory inspection. The package homepage references github.com/aliyun-ai-labs/ai-labs-snippets, pointing to a GitHub organization constructed to appear affiliated with Alibaba's real Aliyun AI offerings.
The package was first published on May 20, 2025, reached 227 total downloads before PyPI removed it, and has zero direct dependents. The single version, 1.0.0, is the only release ever made by the publisher account ai-labs -- a classic single-purpose attacker account.
Attack Analysis
This attack exploits a well-documented but frequently underestimated attack surface in the PyTorch ecosystem: the unsafe deserialization path in torch.load. When called with weights_only=False, PyTorch uses Python's pickle protocol to deserialize the model file, and pickle deserialization can execute arbitrary Python code. Attackers who control a model.pt file can embed a malicious reduce payload that runs any code they choose when the file is loaded.
The attack chain is compact. When a developer runs pip install aliyun-ai-labs-sdk, the package's install lifecycle hook runs setup.py. The setup.py bundles a model.pt file into the installed package alongside init_model.py, which is executed at import time. init_model.py calls torch.load(model_path, map_location='cpu', weights_only=False), triggering pickle deserialization and executing whatever payload is embedded in the model file. The init.py suppresses all Python warnings with warnings.filterwarnings("ignore") -- a deliberate step to hide the security warning that PyTorch emits when weights_only=False is used.
The model.pt file present in the archived distribution is 0 bytes -- the actual malicious payload was either never staged or was stripped before analysis. This is consistent with a reconnaissance or staging package: the attack infrastructure is in place, but the payload itself is delivered separately or was not yet deployed. The core.py file contains a reference to a C2-style domain at https://api.ai-labs.com, which is likely the runtime callback endpoint.
Armando's analysis identified an injection-attempt signal in a string literal within setup.py, and the package's complete infrastructure -- the model loader, the warning suppressor, the attacker-controlled domain -- points to a deliberate and purpose-built attack targeting ML developers.
Malicious Files
setup.py is the install lifecycle entry point. It bundles model.pt into the installed package and triggers installation of the rest of the package. Armando found an injection-attempt signal embedded in a string literal at line 38. The setup.py is flagged as Text.Trojan.SupplyChain.
PKG-INFO is the package metadata file that presents the package as a legitimate Alibaba Aliyun AI SDK. It is used as part of the social engineering layer and has been classified as Text.PUA.SupplyChain by the RL scanner.
init_model.py (not independently flagged as a separate IOC file, but central to the attack mechanism) executes torch.load on the bundled model.pt with weights_only=False, enabling arbitrary code execution via PyTorch pickle deserialization. The try/except blocks around the torch import and torch.load call silently absorb errors, ensuring the package does not raise exceptions on machines without PyTorch installed.
Recommendations
Developers and security teams should take the following steps:
- Identify exposure: Check whether aliyun-ai-labs-sdk v1.0.0 appears in your dependency tree, including transitive dependencies. Any pipeline that ran pip install while this version was current should be considered potentially affected.
- Update immediately: Remove aliyun-ai-labs-sdk from your environment entirely -- there is no clean version to upgrade to. This package is a purpose-built attacker construct with no legitimate use.
- Inspect affected systems: On machines that installed the malicious version, audit for unexpected outbound connections to api.ai-labs.com and examine Python process history for signs of payload execution.
- Review torch.load usage: Audit your codebase and dependencies for any use of torch.load with weights_only=False or without explicit weights_only=True. This is the attack surface this campaign exploits.
- Scan your software supply chain: Use Spectra Assure Community to check whether packages in your environment have been flagged.
Indicators of Compromise
Malicious Files
| Filename | SHA256 | Detection |
|---|
| PKG-INFO | f11a748c58112947063e304f872cf1c28c3881a469b7f2a191bcc03a145b8846 | Text.PUA.SupplyChain |
| setup.py | 552c43b5db5dbc04d6e4f6792cd69b56a8a00e6f4946c105e2c21cba16a3e745 | Text.Trojan.SupplyChain |
Network IOCs
| URL / IP | Purpose |
|---|
| https://api.ai-labs.com | C2 callback domain referenced in core.py; likely the runtime exfiltration or payload delivery endpoint |
Archive Hashes
| File | SHA256 |
|---|
| aliyun_ai_labs_sdk-1.0.0.tar.gz | 21f66487644c198f75b3a0582fbc0aa619f6a0ebdc0ff5c36d1e18e906856d0d |
| aliyun_ai_labs_sdk-1.0.0.tar | 2e57dafabc4bcd90052109f0ca0f7490119ade5b997c351ddee808a980a664df |