"PyTorch Machine Learning Framework Compromised with Malicious Dependency"

Following a dependency confusion attack, the PyTorch package maintainers have advised users who installed nightly editions of the library between December 25, 2022, and December 30, 2022, to remove and download the most recent versions. PyTorch-nightly Linux packages installed via pip during the affected time period installed a dependency, "torchtriton," which was compromised on the Python Package Index (PyPI) code repository and executed a malicious binary, the PyTorch team said. Similar to Keras and TensorFlow, PyTorch is an open-source Python-based Machine Learning (ML) framework that was originally developed by Meta Platforms. The PyTorch team reported learning about the malicious dependence on December 30. The supply chain attack involved uploading a malware-infected version of the legitimate dependency torchtriton to the PyPI code repository. Since package managers such as pip look for a package in public code registries like PyPI before private registries, the fraudulent module was installed on users' systems rather than the true version obtained from the third-party index. The malicious variant is designed to steal system information, such as environment variables, the current working directory, and the host name. This article continues to discuss the compromise of the PyTorch ML framework with a malicious dependency. 

THN reports "PyTorch Machine Learning Framework Compromised with Malicious Dependency"