PyTorch Nightly:
Sure, and they have been for decades. They’re still not that common though.
What Python package almost got you?
I wonder if I’ve been hit but just haven’t noticed because I tend to run things in containers.
brucethemoose@lemmy.world 3 days ago
brucethemoose@lemmy.world 3 days ago
Pytorch Nightly: pytorch.org/blog/compromised-nightly-dependency/
theregister.com/…/pypi_pytorch_dependency_attack/
Was pretty scary from my perspective.
sugar_in_your_tea@sh.itjust.works 3 days ago
That is scary. But it does require using a custom repository, so hopefully few were hit.
We use poetry, enough which allows specifying additional package repos and it looks like we’d be susceptible to the same attack, but for our internal package index. Looks like I have something to fix this week, thanks for the link!