Malicious PyPI torchtriton Package Targeted PyTorch Nightly Users
Summary
A malicious torchtriton package on PyPI exploited pip’s package selection to target Linux PyTorch nightly installs from Dec. 25–30, 2022, collecting system data and files. Users were advised to remove it and rotate exposed secrets.
Key points
- The package name matched a dependency on the PyTorch nightly index; pip could prioritize the PyPI copy when using extra-index-url.
- The affected scope was PyTorch nightly on Linux installed via pip from Dec. 25–30, 2022; stable PyTorch packages were not affected.
- The malicious package was downloaded more than 3,000 times before removal. Its binary collected system details and files, including SSH and Git configuration.
- Collected data was uploaded through DNS tunneling to h4ck[.]cfd using the DNS server wheezy[.]io.
- The binary ran only when the triton package was explicitly imported, not by default PyTorch behavior.
- The package creator claimed to have had no malicious intent and to have deleted collected data; that claim was unverified.
- Users were advised to check environments, uninstall the package, purge the pip cache, and scan affected resources for secrets and rotate discovered keys.
Article Details
- Event Type
- Software supply-chain attack involving a malicious PyPI package
- Impact
- The malicious torchtriton package could be installed instead of the legitimate PyTorch nightly dependency on Linux via pip from December 25 through December 30, 2022. When imported, its binary collected system information and files, then uploaded the data via DNS tunneling. More than 3,000 downloads were reported. PyTorch stable packages were not affected; the creator’s claim of no malicious intent and deletion of collected data was unverified.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 9c89731a94dd4f2a594a22c1b171cb6c20f55e41 | SHA1 hash identified by the source for the malicious torchtriton package. |
| SHA256 | 2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e | SHA256 hash identified by the source for the malicious torchtriton package. |
MITRE ATT&CK
Products
PyTorchto the Python Package Index (PyPI) code repository, with the same name as the package shipped on the PyTorch nightly package index. Due to the way pip (a package-management system for Python) handles packagePyTorch-nightlyPyTorch-nightly on Linux installed via pip between December 25, 2022 and December 30, 2022. torchtritonA package called torchtriton was uploaded to the Python Package Index (PyPI) code repository, with the same name as the package shipped on the PyTorch nightly package index. Due to the way pip (a package-management