The maintainer of the PyTorch package warns users who installed nightly builds of the library between Dec 25th, 2022 and Dec 30th, 2022 to uninstall and download the latest version due to a dependency confusion attack. Did.
“The PyTorch-nightly Linux package installed via pip meanwhile installed dependencies. torch tritonwas compromised in the Python Package Index (PyPI) code repository and executed a malicious binary,” the PyTorch team said in an alert over the weekend.
Similar to Keras and TensorFlow, PyTorch is an open source Python-based machine learning framework originally developed by Meta Platforms.
The PyTorch team said it became aware of the malicious dependency on December 30th at 4:40pm GMT. Supply His chain attack involved uploading a copy of a legitimate dependency named torchtriton laced with malware to the Python Package Index (PyPI) code repository.
Package managers like pip check public code registries, such as PyPI, for packages before private registries, so they see bad modules on the user’s system as opposed to the actual version retrieved from a third-party index. I was able to install it.
The malicious version is designed to steal system information such as environment variables, current working directory and hostname as well as access the following files –
- /etc/host
- /etc/password
- First 1,000 files in $HOME/*
- $HOME/.gitconfig
- $HOME/.ssh/*
In a statement shared with Bleeping Computer, the owner of the domain where the stolen data was sent claimed it was part of an ethical research effort and all data has since been deleted.
As a mitigation, torchtriton has been removed as a dependency and replaced with pytorch-triton. To prevent further exploitation, he has also registered a dummy package as a placeholder on PyPI.
“This is not the actual torchtriton package, but was uploaded here to discover a dependency confusion vulnerability,” a message appears on torchtriton’s PyPI page. “A real torchtriton is available at https://download.pytorch.[.]org/whl/nightly/torchtriton/.”
This development also comes when JFrog reveals details of another package known as cookiezlog. This package has been observed to utilize anti-debugging techniques to resist analysis, making it the first time such a mechanism has been incorporated into his PyPI malware.
