PYPI-TORCHTRITON-2022

Summary

Between December 25 and December 30, 2022, a dependency confusion attack hit PyTorch-nightly. An attacker uploaded a malicious package named 'torchtriton' to the public PyPI index with a higher version than the legitimate one shipped on PyTorch's own index; because pip prioritized PyPI, the malicious package was installed by default. The payload collected system fingerprint data (IP, hostname, username, working directory), read sensitive files such as /etc/passwd and SSH keys, and exfiltrated them. PyTorch renamed the dependency to 'pytorch-triton' and reserved a dummy PyPI package to prevent recurrence.

References

• https://pytorch.org/blog/compromised-nightly-dependency/
• https://www.wiz.io/blog/malicious-pytorch-dependency-torchtriton-on-pypi-everything-you-need-to-know
• https://thehackernews.com/2023/01/pytorch-machine-learning-framework.html