Compromised PyTorch-nightly dependency chain between December 25th and December 30th, 2022

ConvolutionalAtom: <p>Important <strong>Security</strong> update for those installed nightly version between 25th and 30th of December</p>
<aside class="onebox allowlistedgeneric" data-onebox-src="https://pytorch.org/blog/compromised-nightly-dependency/">
  <header class="source">
      <img src="https://pytorch.org/favicon.ico?" class="site-icon" width="32" height="32">

      <a href="https://pytorch.org/blog/compromised-nightly-dependency/" target="_blank" rel="noopener nofollow ugc">pytorch.org</a>
  </header>

  <article class="onebox-body">
    <img src="https://pytorch.org/assets/images/pytorch-logo.png" class="thumbnail onebox-avatar" width="500" height="500">

<h3><a href="https://pytorch.org/blog/compromised-nightly-dependency/" target="_blank" rel="noopener nofollow ugc">PyTorch</a></h3>

  <p>An open source machine learning framework that accelerates the path from research prototyping to production deployment.</p>


  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>

<p>Note: torchdynamo seemed relevant since it is an important motivation for trying out nightly version 2.0</p>

ptrblck: <p>Thanks for cross-posting it here. I’ll change the topic a bit to clarify the security risk.</p>
<p>EDIT: let me also pin the topic</p>

ptrblck: 

ConvolutionalAtom: <p><a class="mention" href="/u/ptrblck">@ptrblck</a> Quick question: Is there any new step in CI/CD pipeline to make sure that this type of particular supply chain attack, where one can make sure that there is no free pypi package that can overwrite those from Pytorch nightly index. Or will the pytorch team make sure to create ‘dummy-packages’ of their own on pypi ?</p>
<p>Also, I saw the message from pypi webpage of malicious package. It says</p>
<p>This is not the real torchtriton package but uploaded here to discover dependency confusion vulnerabilities. You can get the real torchtriton from <code>https://download.pytorch.org/whl/nightly/torchtriton/</code></p>
<p>Did the author really create the package to ‘discover’ or is it just a misdirection?</p>

ptrblck: <aside class="quote no-group" data-username="ConvolutionalAtom" data-post="4" data-topic="169376">
<div class="title">
<div class="quote-controls"></div>
<img loading="lazy" alt="" width="24" height="24" src="https://discuss.pytorch.org/user_avatar/discuss.pytorch.org/convolutionalatom/48/45668_2.png" class="avatar"> ConvolutionalAtom:</div>
<blockquote>
<p>Quick question: Is there any new step in CI/CD pipeline to make sure that this type of particular supply chain attack, where one can make sure that there is no free pypi package that can overwrite those from Pytorch nightly index. Or will the pytorch team make sure to create ‘dummy-packages’ of their own on pypi ?</p>
</blockquote>
</aside>
<p>Creating placeholder packages is the common approach to prevent such attacks, which is also what NVIDIA does with CUDA packages and other libs.<br>
In fact <a class="mention" href="/u/malfet">@malfet</a> already created a placeholder for <code>pytorch-triton</code> which is the new name of the package to avoid future attacks. I don’t know if specific tests are executed in CI to double check it.</p>
<aside class="quote no-group" data-username="ConvolutionalAtom" data-post="4" data-topic="169376">
<div class="title">
<div class="quote-controls"></div>
<img loading="lazy" alt="" width="24" height="24" src="https://discuss.pytorch.org/user_avatar/discuss.pytorch.org/convolutionalatom/48/45668_2.png" class="avatar"> ConvolutionalAtom:</div>
<blockquote>
<p>Did the author really create the package to ‘discover’ or is it just a misdirection?</p>
</blockquote>
</aside>
<p>At this point in time I would not trust this message and assume the description is misleading.</p>

squirrelai: <p>Does anyone know if running either of the following with the vulnerable nightly packages would have executed the torchtriton malware:</p>
<pre><code class="lang-auto">import torch
torch.cuda.is_available()
</code></pre>
<pre><code class="lang-auto">python -m torch.utils.collect_env
</code></pre>
<p>Based on the blog post it says you would have had to have imported torchtriton, but does importing pytorch also import torchtriton?</p>
<blockquote>
<p>The malicious binary is executed when the triton package is imported, which requires explicit code to do and is not PyTorch’s default behavior.</p>
</blockquote>
<p>Also, does anyone know around what time in GMT on December 30th the impacted nightlys were removed from pip? I see the <a href="https://github.com/pytorch/pytorch/commit/bc92444b34dfbe38419a1c8dbea9a7fc3284abe2" rel="noopener nofollow ugc">commit to remove torchtriton in the github.com repo at Dec 30th at 22:49 GMT</a> and am hoping the pip packages were removed around then, too.</p>
<p>Thanks!</p>