PyTorch identifies a malicious dependency using its “torchtriton” library name, warning nightly version users to uninstall; the hacker claims ethical research
BleepingComputerAx Sharma
Context & Ripple Effects
PyTorch's warning centers on a package-name impersonation aimed at users of nightly builds, making the software supply chain—not the framework's core code—the immediate trust boundary. Later coverage broadens that concern: malicious AI models on Hugging Face and TorchServe remote-code-execution flaws show distinct routes by which AI development and deployment environments can expose users to code execution.
The incident is an early example of a problem that persists across AI tooling: trusted names, packages, models, and serving components each become attack surfaces when users treat ecosystem artifacts as safe by default.
First-order effects
PyTorch nightly-build users must remove the malicious dependency, while PyTorch has to contain confusion created by use of the “torchtriton” name.
The claimed research intent does not change the operational consequence for developers: a dependency associated with the PyTorch ecosystem has to be treated as untrusted and removed.
Second-order effects
Teams using PyTorch nightly builds face added dependency-review work, and package publishers must more clearly distinguish official components from similarly named third-party artifacts.
The episode reinforces the relevance of safeguards across the AI stack, from packages to model downloads that can execute code and model-serving deployments.
Third-order effects
AI software ecosystems are likely to treat provenance verification as a core distribution requirement rather than an administrative check, because attackers can target names and artifacts users already trust.
As package, model, and extension ecosystems expand, security responsibility shifts toward maintaining trusted-tool boundaries across the full AI supply chain.
The trend: AI development is becoming a software-supply-chain security problem in which trusted ecosystem names and distributable artifacts are recurring attack vectors.
False alarm. PyTorch supply chain attack was later revealed to be an individual from HackerOne who did an oopsy. Information courtesy of @bad_requests https://twitter.com/...
If you installed PyTorch-nightly on Linux between Dec. 25 and Dec. 30, uninstall it and torchtriton immediately and use the latest nightly binaries. Read the security advisory here: https://pytorch.org/... https://twitter.com/...
Not sure what to think of this turn of events 🤔 Either a very clumsy honest person, or a savvy person who realized they're about to get caught. https://twitter.com/...
They further state that they'd deleted the data they received and reported the flaw to Facebook/Meta AI, who is PyTorch's original developer prior to PyTorch's disclosure (which btw, clearly calls the attack “malicious")
JUST IN: In a statement, the creator of counterfeit ‘torchtriton’ has apologized and stressed that their intent wasn't malicious. They claim collecting sensitive data, including keys and secrets—which they call a “wrong decision,” was to better identify victims. https://twitter.c…
It's good that PyTorch found this so quickly. However it makes me worry that many packages share this issue without realizing. You could easily clone pip wheels and add exploits without being obvious. The fragmentation of the ecosystem (see xkcd) is seeing some consequences... ht…
This is dependency confusion attack once again - https://medium.com/.... You should be pinning your deps using pipfile.lock/poetry.lock (hopefully python natively supports lock files one day) and long-term package signing with SLSA provenance coming! https://twitter.com/...
Happy New Year. - PyTorch nightly build suffered from a supply chain attack which exfiltrated sensitive data. Stable versions unaffected. - Lisbon, Ohio court house system hit by ransomware, servers shown to be vulnerable to ProxyNotShell exploit. Have a nice day
PyTorch reveals malicious dependency chain compromise between Dec 25th & 30th. The counterfeit ‘tortchtrion’ stole SSH keys, first 1000 files in $HOME, .gitconfig and other secrets. 2,300+ downloads seen so far on PyPI. Uninstall now 👇👇👇 https://www.bleepingcomputer.com/ ... #ope…
The PyTorch team is taking all the right measures here, but this is another reminder of the importance of the work on sigstore and other tools that @di_codes and the rest of the PyPI security team are leading work on. https://twitter.com/...
PyTorch-nightly compromised in a supply-chain attack. 1. Malicious dependency: torchtriton - https://snyk.io/... (~2033 downloads); 2. Only PyTorch-nightly on Linux installed via pip was impacted; 3. Timeframe: 25 December - 30 December; Source: https://pytorch.org/...