{
  "affects": {
    "artifacts": [
      {
        "name": "PyTorch",
        "type": "System"
      }
    ],
    "deployer": [
      "PyTorch"
    ],
    "developer": []
  },
  "credit": [
    {
      "lang": "eng",
      "value": "PyTorch"
    }
  ],
  "data_type": "AVID",
  "data_version": "0.2",
  "description": {
    "lang": "eng",
    "value": "Linux packages for PyTorch\u0027s pre-release version, called Pytorch-nightly, were compromised from December 25 to 30, 2022 by a malicious binary uploaded to the Python Package Index (PyPI) code repository.  The malicious binary had the same name as a PyTorch dependency and the PyPI package manager (pip) installed this malicious package instead of the legitimate one.\n\nThis supply chain attack, also known as \"dependency confusion,\" exposed sensitive information of Linux machines with the affected pip-installed versions of PyTorch-nightly. On December 30, 2022, PyTorch announced the incident and initial steps towards mitigation, including the rename and removal of `torchtriton` dependencies."
  },
  "impact": {
    "avid": {
      "lifecycle_view": [
        "L02: Data Understanding",
        "L03: Data Preparation",
        "L04: Model Development",
        "L05: Evaluation",
        "L06: Deployment"
      ],
      "risk_domain": [
        "Security"
      ],
      "sep_view": [
        "S0202: Software Compromise"
      ],
      "taxonomy_version": "0.2"
    }
  },
  "last_modified_date": "2023-03-31",
  "metadata": {
    "vuln_id": "AVID-2023-V015"
  },
  "problemtype": {
    "classof": "ATLAS Case Study",
    "description": {
      "lang": "eng",
      "value": "Compromised PyTorch Dependency Chain"
    },
    "type": "Advisory"
  },
  "published_date": "2023-03-31",
  "references": [
    {
      "label": "Compromised PyTorch Dependency Chain",
      "type": "source",
      "url": "https://atlas.mitre.org/studies/AML.CS0015"
    },
    {
      "label": "PyTorch statement on compromised dependency",
      "type": "source",
      "url": "https://pytorch.org/blog/compromised-nightly-dependency/"
    },
    {
      "label": "Analysis by BleepingComputer",
      "type": "source",
      "url": "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
    }
  ],
  "reports": null
}