Malicious `torchtriton` PyPI Package Steals Sensitive System Information
Overview
A supply chain attack was identified involving a malicious package named `torchtriton` uploaded to the Python Package Index (PyPI). This incident, assigned CVE-2023-49583, was a classic example of typosquatting, targeting developers who might misspell the legitimate `triton` package developed by OpenAI for GPU programming. The malicious package contained a deceptive `setup.py` file that executed a malicious payload upon installation. The payload was a binary, fetched from a remote server, that was designed to exfiltrate sensitive information from the developer's machine. This included system information (hostname, username), network details, and sensitive files such as SSH keys, `/etc/passwd`, and shell history files. The malware specifically searched for and uploaded files related to credentials and system configuration, sending them to an attacker-controlled endpoint. This attack highlights the significant supply chain risks in the AI/ML ecosystem, where developers frequently install numerous packages from public repositories. The dependency on a vast web of open-source components makes AI development pipelines a prime target for attackers aiming to compromise developer machines, steal intellectual property, or gain access to cloud infrastructure credentials.
Affected Systems
Testing Guide
1. **Check Installed Packages:** Run `pip list` in your Python environment and check for the presence of a package named `torchtriton`. 2. **Review Installation Logs:** If you suspect an installation occurred, review shell history and CI/CD logs for commands like `pip install torchtriton`. 3. **Scan Filesystem:** If the package was installed, the system should be considered compromised. A forensic analysis should be conducted, looking for suspicious binaries in user directories (e.g., `~/.local/bin`) and unusual outbound network traffic.
Mitigation Steps
1. **Verify Package Names:** Always double-check the spelling of package names before installation. Use the official documentation as the source of truth for package names. 2. **Use a Pinned `requirements.txt`:** Use hashed and pinned dependency files (`requirements.txt` or `poetry.lock`) to ensure that you are installing known, verified package versions. 3. **Scan Dependencies:** Integrate automated dependency scanning tools (e.g., Snyk, Dependabot, PyUp) into your CI/CD pipeline to check for known malicious or vulnerable packages. 4. **Isolated Environments:** Perform experimental installations in isolated, containerized environments to limit the potential impact of a malicious package.
Patch Details
The malicious package was removed from the PyPI repository. No 'patch' exists; systems must be checked for compromise and the package must be uninstalled.