PyTorch Poisoned in Software Supply Chain Attack - The New Stack

If you downloaded PyTorch-nightly on Linux via pip between Dec. 25, 2022, and Dec. 30, 2022, you've got trouble. Someone, we still don't know who, uploaded a poisoned Python Package Index (PyPI) dependency that hid under the real dependency name, torchtriton. The good news is that this supply chain attack only hit the nightly builds. If you weren't using these, you'd be safe. You might wonder how this could happen since the malicious code wasn't copied over the good version.