PyTorch identifies a malicious dependency that uses its “torchtriton” library name, warning users to uninstall the framework; the hacker claims ethical research
PyTorch has identified a malicious dependency with the same name as the framework's ‘torchtriton’ library.
BleepingComputerAx Sharma
Context & Ripple Effects
PyTorch — now the dominant framework among AI researchers after overtaking TensorFlow — discovered that someone had uploaded a package to the public Python registry under the same name as its internal 'torchtriton' library, meaning nightly-build installs could pull the impostor instead of the real dependency. The maintainer's response is a direct warning to uninstall, while the uploader claims the act was ethical research rather than theft.
The incident reads, in hindsight, as the opening move in an AI-specific supply chain problem that kept recurring: Oligo Security later found RCE flaws in TorchServe exposed at tens of thousands of IPs, JFrog surfaced ~100 malicious PyTorch and Keras models on Hugging Face capable of executing code on user machines, and by 2026 Microsoft was investigating a Mistral AI PyPI package compromise tied to a broader supply chain campaign.
First-order effects
Developers running PyTorch nightly builds who installed the name-squatted package are told to remove it immediately, since their build process silently fetched attacker-controlled code in place of the legitimate library.
PyTorch's own release infrastructure takes the reputational hit: a framework whose dominance rests on researcher trust now has to vouch for every dependency its install commands touch.
Second-order effects
The 'ethical research' claim forces the ecosystem to confront the gray zone between disclosure and attack — registry operators and framework maintainers can no longer treat namespace collisions on public indexes as hypothetical, pushing PyTorch and peers toward private or verified dependency sources.
Attackers demonstrably shift targets along the ML stack rather than abandoning it: the same year saw TorchServe flaws exploited at scale (tens of thousands of vulnerable instances), and model hubs became the next vector once package registries hardened.
Third-order effects
If the pattern holds, AI tooling becomes a systematically targeted supply chain — packages, pretrained models, and serving layers each attacked in turn — making provenance verification and signed distribution baseline requirements for any organization deploying open-source ML.
The recurring incidents give regulators and enterprise buyers concrete grounds to demand software bills of materials and vetted model sources, turning what began as a researcher convenience culture into an audited procurement surface.
The trend: Attacks on the AI software supply chain are escalating from dependency confusion in package registries to poisoned models and compromised serving tools, outpacing the trust practices of the ecosystems they target.
It's good that PyTorch found this so quickly. However it makes me worry that many packages share this issue without realizing. You could easily clone pip wheels and add exploits without being obvious. The fragmentation of the ecosystem (see xkcd) is seeing some consequences... ht…
This is dependency confusion attack once again - https://medium.com/.... You should be pinning your deps using pipfile.lock/poetry.lock (hopefully python natively supports lock files one day) and long-term package signing with SLSA provenance coming! https://twitter.com/...
Happy New Year. - PyTorch nightly build suffered from a supply chain attack which exfiltrated sensitive data. Stable versions unaffected. - Lisbon, Ohio court house system hit by ransomware, servers shown to be vulnerable to ProxyNotShell exploit. Have a nice day
False alarm. PyTorch supply chain attack was later revealed to be an individual from HackerOne who did an oopsy. Information courtesy of @bad_requests https://twitter.com/...
PyTorch reveals malicious dependency chain compromise between Dec 25th & 30th. The counterfeit ‘tortchtrion’ stole SSH keys, first 1000 files in $HOME, .gitconfig and other secrets. 2,300+ downloads seen so far on PyPI. Uninstall now 👇👇👇 https://www.bleepingcomputer.com/ ... #ope…
JUST IN: In a statement, the creator of counterfeit ‘torchtriton’ has apologized and stressed that their intent wasn't malicious. They claim collecting sensitive data, including keys and secrets—which they call a “wrong decision,” was to better identify victims. https://twitter.c…
If you installed PyTorch-nightly on Linux between Dec. 25 and Dec. 30, uninstall it and torchtriton immediately and use the latest nightly binaries. Read the security advisory here: https://pytorch.org/... https://twitter.com/...
PyTorch-nightly compromised in a supply-chain attack. 1. Malicious dependency: torchtriton - https://snyk.io/... (~2033 downloads); 2. Only PyTorch-nightly on Linux installed via pip was impacted; 3. Timeframe: 25 December - 30 December; Source: https://pytorch.org/...
The PyTorch team is taking all the right measures here, but this is another reminder of the importance of the work on sigstore and other tools that @di_codes and the rest of the PyPI security team are leading work on. https://twitter.com/...