Case torchtriton-pypi-dependency-confusionAI supply chainWorldwide
Malicious 'torchtriton' dependency confusion package hits PyTorch via PyPI
PyTorch developers identified a malicious torchtriton dependency on PyPI, a dependency confusion attack; security teams were advised to check for infected resources and rotate exposed keys.
HighAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Dec 30, 2022
- Location
- Worldwide
- Target
- PyTorch users and the PyPI ecosystem
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
PyTorch developers identified a malicious torchtriton dependency on PyPI, a dependency confusion attack; security teams were advised to check for infected resources and rotate exposed keys.
Impact: Systems that installed the package may be infected and have keys exposed; scale not stated.
Who triggered it
Actor: Unknown
Attribution: Not stated in the summary.
Motive: Unknown
How it happened
Attack vector: Dependency confusion attack using a malicious torchtriton package on PyPI
Root cause: Dependency confusion in the open-source PyTorch project's dependency resolution.
Timeline
- Reported by Wiz Research
Response
PyTorch developers identified the malicious dependency; teams advised to check for infected resources and rotate exposed keys.
Current status: Contained
Sources (open in a new tab)
- Wiz Research wiz.io
Cite this case
Malicious 'torchtriton' dependency confusion package hits PyTorch via PyPI. AI Threat Watch, case torchtriton-pypi-dependency-confusion, Dec 30, 2022. https://aithreat.io/cases/torchtriton-pypi-dependency-confusion/
Permanent link: https://aithreat.io/cases/torchtriton-pypi-dependency-confusion/