Malicious PyPI Package 'torch-triton' Steals Sensitive Files from AI Developer Environments
Overview
A malicious package named `torch-triton` was discovered on the Python Package Index (PyPI), targeting AI and machine learning developers. This package was a typosquat of the legitimate `pytorch-triton` library developed by OpenAI. The malicious package contained hostile code within its `setup.py` file. Upon installation via `pip install torch-triton`, the script would execute with the user's permissions. The payload was designed to exfiltrate sensitive data from common developer locations. Specifically, it would search for and upload files like `~/.ssh/id_rsa`, `~/.aws/credentials`, `~/.git-credentials`, and shell history files to an attacker-controlled endpoint using a DNS-over-HTTPS (DoH) tunneling technique to evade simple network firewalls. The attack proved highly effective because AI developers frequently work with powerful cloud credentials and private code repositories, making them a high-value target. This incident served as a stark reminder of the persistent threat of supply chain attacks within the rapidly growing AI ecosystem, where developers often install numerous third-party packages without thorough vetting.
Affected Systems
Testing Guide
1. Review your project's `requirements.txt` or equivalent dependency file for the package `torch-triton` (note the hyphen). 2. Run `pip freeze | grep torch-triton` in your shell to check if the malicious package is installed in your current environment. 3. Analyze historical shell and CI/CD logs for installation commands related to this package. 4. Check network logs for suspicious DNS or HTTP requests to unknown domains originating from build servers or developer machines around the time of package installations.
Mitigation Steps
1. **Pin Dependencies**: Use a dependency management tool (like Poetry or pip-tools) to pin package versions and use cryptographic hashes (`--require-hashes`) in your `requirements.txt` file. 2. **Audit Packages**: Regularly scan installed packages and dependencies for known vulnerabilities using tools like `pip-audit` or `safety`. 3. **Use Virtual Environments**: Always install packages within isolated virtual environments to limit the potential blast radius of a malicious script. 4. **Scrutinize Package Names**: Double-check the spelling of package names before installation to avoid typosquatting attacks. 5. **Restrict Network Access**: In CI/CD environments, restrict outbound network access to only trusted package repositories and necessary endpoints.
Patch Details
The malicious package was removed from PyPI by the registry's security team on August 2, 2025.