Pytorch Nightly: pytorch.org/blog/compromised-nightly-dependency/
theregister.com/…/pypi_pytorch_dependency_attack/
The malicious binary would upload files ranging in size up to 99,999 bytes and send the contents to a specified domain.
Was pretty scary from my perspective.
sugar_in_your_tea@sh.itjust.works 3 weeks ago
That is scary. But it does require using a custom repository, so hopefully few were hit.
We use poetry, enough which allows specifying additional package repos and it looks like we’d be susceptible to the same attack, but for our internal package index. Looks like I have something to fix this week, thanks for the link!