{
  "entry": {
    "kind": "vuln",
    "slug": "three-typosquatted-ai-labs-sdk-pypi-packages-exfiltrate-developer",
    "name": "three-typosquatted-ai-labs-sdk-pypi-packages-exfiltrate-developer",
    "vendor": "\"AI Labs SDK\" PyPI packages",
    "description": "Three malicious packages typosquatting AI Labs were published to PyPI on May 19 and available for less than 24 hours, accumulating ~1,600 installs. The packages contained no actual SDK functionality, only reconnaissance code that exfiltrated hostname, username, installed Python packages, presence of cloud-credential files, and the listing of ~/.config and project root contents to an attacker-controlled server. The recon profile suggests a follow-on targeted attack on the harvested machines.",
    "website": "https://www.reversinglabs.com/blog/malicious-attack-method-on-hosted-ml-models-now-targets-pypi",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-05-19",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "three-typosquatted-ai-labs-sdk-pypi-packages-exfiltrate-developer",
      "aliases": [
        "ti-029"
      ],
      "title": "Three Typosquatted \"AI Labs SDK\" PyPI Packages Exfiltrate Developer Reconnaissance Data",
      "summary": "Three malicious packages typosquatting AI Labs were published to PyPI on May 19 and available for less than 24 hours, accumulating ~1,600 installs. The packages contained no actual SDK functionality, only reconnaissance code that exfiltrated hostname, username, installed Python packages, presence of cloud-credential files, and the listing of ~/.config and project root contents to an attacker-controlled server. The recon profile suggests a follow-on targeted attack on the harvested machines.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise"
      ],
      "componentType": "agent",
      "component": {
        "name": "\"AI Labs SDK\" PyPI packages",
        "vendor": null,
        "package": null,
        "ecosystem": "pypi",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "\"AI Labs SDK\" PyPI packages (3 names, removed within 24h of May 19)",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-05-19",
      "modifiedAt": "2026-05-19",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.reversinglabs.com/blog/malicious-attack-method-on-hosted-ml-models-now-targets-pypi"
        }
      ],
      "mitigation": "Audit pip install history on developer machines for AI Labs / ai-labs-sdk style names installed May 19. Block typosquatting via PyPI mirror with allowlisted package names. Treat any machine that installed one of these packages as compromised and rotate local cloud credentials.",
      "detectedByAnomity": true
    }
  }
}