PyTorch Poisoned in Software Supply Chain Attack

2 years ago thenewstack.io

Summary: This is a summary of an article originally published by The New Stack. Read the full original article here →

If you downloaded PyTorch-nightly on Linux via pip between Dec. 25, 2022, and Dec. 30, 2022, you’ve got trouble. Someone, we still don’t know who, uploaded a https://pytorch.org/blog/compromised-nightly-dependency/ that hid under the real dependency name, torchtriton.

The good news is that this supply chain attack only hit the nightly builds.

You might wonder how this could happen since the malicious code wasn’t copied over the good version. The PyTorch Team explained, “Since the https://github.com/pypa/pip/issues/8606, this malicious package was being installed instead of the version from our official repository.

DevOps Articles