# Malicious PyTorch dependency 'torchtriton' on PyPI: everything you need to know

Malicious torchtriton package on PyPI shadowed PyTorch nightly's index package, exfiltrating host info, SSH keys and git config via DNS tunneling to h4ck.cfd.

- Payout: Real-world hack
- Severity: high
- Program: PyTorch
- Credited: Wiz Research
- Disclosed: 2023-01-03
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/malicious-pytorch-dependency-torchtriton-on-pypi-everything-you-need-to-know
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-malicious-pytorch-dependency-torchtriton-on-pypi-everything-you-need-to-know
- Tags: domain:oss impact:data-leak kind:incident platform:threat-intel sev:high tech:python technique:oob-exfil vuln:dependency-confusion vuln:secrets-leak

**Target:** PyPI package dependency (torchtriton) installed via pip extra-index-url
**Root cause:** pip prioritizes packages on PyPI over the extra-index-url nightly index, so an attacker-uploaded package with the same name as the internal torchtriton package was installed by default.
**Steps:**
1. Install PyTorch nightly via pip with `--extra-index-url https://download.pytorch.org/whl/nightly/cu117` between 2022-12-25 and 2022-12-30
2. pip resolves `torchtriton` from PyPI instead of the nightly index
3. Malicious binary installed at `PYTHON_SITE_PACKAGES/triton/runtime/triton`
4. On `import triton`, binary collects `/etc/resolv.conf`, hostname, username, cwd, env vars, `/etc/hosts`, `/etc/passwd`, first 1000 files in `$HOME/*`, `$HOME/.gitconfig`, `$HOME/.ssh/`
5. Data exfiltrated via DNS tunneling to `.h4ck[.]cfd` through DNS server `wheezy[.]io`
6. Detect with `python3 -c "import importlib.util,pathlib;..."` check; uninstall with `pip3 uninstall -y torch torchvision torchaudio torchtriton` and `pip3 cache purge`
**Exploitation:** Attacker uploaded a same-named package to public PyPI; pip's index priority caused nightly installers to pull it. The bundled triton binary harvested credentials and files and tunneled them out over DNS to attacker-controlled domain, yielding SSH keys and secrets from ~3000 victims.
**Insight:** When auditing pip installs using `--extra-index-url`, check whether internal-only dependency names are claimed on public PyPI; pip prefers the public index, so unclaimed names are hijackable. Also watch for DNS tunneling exfil domains in package binaries.