Alert on PyTorch-nightly malicious code contamination

2023.01.06

Between December 25 and December 30, 2022, a problem occurred in which a malicious third party installed malicious code with information leakage when installing and updating nightly builds of PyTorch.

If you are using a nightly build of PyTorch, please check to see if you are affected by this issue by using the following command, and if so, please let us know using the contact form.

python3 -c "import pathlib;import importlib.util;s=importlib.util.find_spec('triton'); affected=any(x.name == 'triton' for x in (pathlib.Path(s.submodule_search_locations[0] if s is not None else '/' ) / 'runtime').glob('*'));print('You are {}affected'.format('' if affected else 'not '))"

The stable build of PyTorch is not affected by this issue.

Reference URL:

• Compromised PyTorch-nightly dependency chain between December 25th and December 30th, 2022. - PyTorch公式
• 機械学習フレームワーク「PyTorch」に不正プログラム混入のおそれ - Security Next