Sophisticated PyPI Package *hermes-px* Exfiltrates User Data via Stolen AI Infrastructure Security researchers at JFrog have identified a highly deceptive malicious package on PyPI, hermes-px, designed to steal user data under the guise of a secure AI proxy. Marketed as a tool for anonymous OpenAI-compatible requests routed through Tor, the package instead hijacks a private university’s AI endpoint, repurposes a stolen Anthropic Claude system prompt, and exfiltrates user prompts directly to attackers. Unlike typical malicious packages, hermes-px is meticulously crafted to appear legitimate, featuring detailed documentation, code examples, error-handling guides, and a functional Retrieval-Augmented Generation (RAG) pipeline. It mimics the OpenAI Python SDK’s API surface and claims affiliation with a fictional company, EGen Labs, to encourage integration into real projects. However, its README instructs users to execute arbitrary Python code from a now-removed GitHub repository, enabling dynamic payload updates. At its core, the package contains a compressed 246,000-character file, base_prompt.pz, which reveals a near-complete copy of a leaked Anthropic Claude system prompt. Attackers attempted to rebrand it as AXIOM-1 under EGen Labs, but incomplete modifications left traces of its original source. The package sanitizes AI responses to replace references to OpenAI or ChatGPT with EGen Labs, reinforcing the deception. The most damaging component is its exfiltration module, which bypasses Tor entirely. While AI inference requests are routed through Tor to obscure the abuse of the university’s endpoint, telemetry including unmodified user prompts, full AI responses, and real IP addresses is sent directly to an attacker-controlled Supabase database. Sensitive strings, such as database credentials and target URLs, are protected by triple-layer encryption to evade detection. JFrog’s findings highlight the package’s ability to undermine its own promised anonymity while silently harvesting sensitive data from unsuspecting developers.