Poisoned Pipeline / Incidents / AS109
PyTorch-nightly torchtriton dependency confusion
Between 25 and 30 December 2022, Linux pip installs of PyTorch-nightly
pulled a malicious torchtriton from PyPI instead of the namesake package
on PyTorch’s own index, because PyPI takes precedence. The extra binary
stole environment variables and files from the home directory. Stable
PyTorch packages were not affected. PyTorch’s own advisory is the
primary record; they replaced the dependency with pytorch-triton and
registered a dummy on PyPI. The inherited mapping treated this as T0113
(compromised user account); it is T0120.
Mapped techniques
- T0120 Dependency confusion
- T0109 Publish malicious artifact
- T0107 Discover internal artifacts names
- T0151 Installation scripts
- T0140 Harvest tokens from environment variables
- T0201 Customers compromised
supply-chain torchtriton on PyPI
Same name as the internal nightly dependency; PyPI won the resolve.
Malicious torchtriton uploaded to the public index.
The attacker needed the unpublished name torchtriton.
post-supply-chain PyTorch-nightly users
pip install of nightly pulled and ran the malicious wheel.
Env vars and home-directory files were exfiltrated.
Anyone who pip-installed Linux nightly in that five-day window.