Loading story…
A malicious torchtriton package on PyPI impersonated a dependency supplied through PyTorch’s nightly package repository. PyTorch nightly installations made between December 25 and 30, 2022, could retrieve the attacker’s package because pip’s --extra-index-url behavior allowed the public PyPI package to take precedence, a dependency-confusion condition. Stable PyTorch releases were not affected.
The malicious package installed a trojanized Triton binary that collected host and environment information plus sensitive local files, then exfiltrated the data through DNS queries to attacker-controlled infrastructure. PyTorch advised affected users to remove the impacted packages, clear pip caches, investigate systems for exposed secrets, and rotate any credentials found on compromised hosts.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
PyTorch nightly installations on Linux made with pip's extra-index-url configuration were susceptible to installing the malicious PyPI torchtriton package instead of the legitimate nightly-index version. The affected installation window ran between December 25 and December 30, 2022; stable PyTorch releases were unaffected.
The malicious package, downloaded more than 3,000 times, was removed from PyPI and replaced with a placeholder package named pytorch-triton. Its installed triton binary had collected host and local-file data and exfiltrated it through DNS tunneling.
An attacker uploaded a PyPI package named torchtriton that impersonated the legitimate torchtriton package distributed through PyTorch's nightly package index.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
wiz.io
Open sourcepytorch.org
Open sourcecloudvulndb.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two widely used Python packages, **LiteLLM** and **PyTorch Lightning**, were distributed on PyPI with malicious code that executed during installation or import and attempted to steal credentials and establish persistence. In the LiteLLM incident, versions `1.82.7` and `1.82.8` were flagged as compromised, with maintainers and downstream projects warning that a `litellm_init.pth` file contained data-exfiltration malware that sent information to `models.litellm.cloud`. Public advisories and community tooling were released to help users determine whether their machines had been affected, while third-party analysis described the package as combining credential theft with a persistent backdoor. In the PyTorch Lightning incident, version `2.6.3` on PyPI was found to trigger a hidden execution chain as soon as the package was imported, launching a background process that downloaded the **Bun** runtime from GitHub and ran an obfuscated JavaScript payload named `router_runtime.js`. Microsoft Threat Intelligence said Defender detected and blocked the activity, tracked as **ShaiWorm**, and reported that only a small number of devices in a narrow set of environments were affected. The malware targeted browser data, `.env` files, API keys, GitHub tokens, and cloud credentials across **AWS**, **Azure**, and **GCP**, and also supported arbitrary command execution; Lightning AI reverted the package to `2.6.1`, urged anyone who imported `2.6.3` to rotate all secrets immediately, and said it is investigating a possible compromise of its build or release pipeline.
Jun 29, 2026
Malicious versions `1.82.7` and `1.82.8` of the widely used `litellm` Python package were uploaded to PyPI after attackers used compromised publishing access, turning a popular AI gateway library into a supply-chain malware delivery vehicle. Researchers and project maintainers said the tainted code was absent from the upstream GitHub repository, indicating the compromise occurred in the release pipeline or during package publication. The malware executed on import in `1.82.7`, while `1.82.8` added a `litellm_init.pth` file that triggered on every Python interpreter startup, greatly expanding exposure even beyond direct use of the package. PyPI removed or quarantined the malicious releases, and `1.82.6` was identified as the last known clean version. The payload harvested a broad range of secrets, including cloud credentials, SSH keys, API tokens, Kubernetes service-account tokens, database and CI/CD secrets, `.env` files, shell histories, TLS keys, and cryptocurrency wallet data, then encrypted and exfiltrated the data to attacker-controlled infrastructure including `models.litellm.cloud`. Multiple reports said the malware also attempted Kubernetes lateral movement by enumerating clusters, dumping secrets, and deploying privileged pods across nodes, while establishing Linux persistence through a disguised `systemd` user service that contacted `checkmarx.zone` for follow-on payloads. Researchers linked the intrusion with high confidence to **TeamPCP**, tying it to the earlier Trivy compromise and a broader campaign spanning GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI; organizations that installed and ran the affected versions were urged to assume full credential compromise, rotate secrets, inspect for persistence, and review Kubernetes environments for rogue activity.
Jul 29, 2026
Microsoft Threat Intelligence warned that version `2.4.6` of the widely used `mistralai` package on PyPI was compromised in a software supply-chain attack, with malicious code inserted into `mistralai/client/__init__.py`. The code executed on import, retrieved a second-stage payload from a remote server, and deployed malware on Linux systems. The payload was written to `/tmp/transformers.pyz` to resemble legitimate Hugging Face tooling, while additional components including `pgmonitor.py` and a persistent `systemd` service named `pgsql-monitor.service` were used to blend into developer and database-monitoring environments. Microsoft said the malware primarily targeted credentials and persistence, with the potential to expose GitHub tokens, cloud API keys, SSH keys, npm credentials, and CI/CD secrets. Researchers said the intrusion may be tied to the broader **Mini Shai-Hulud** campaign, which has also been associated with compromised TanStack packages and multiple Mistral npm SDK packages, suggesting an expanding effort against developer ecosystems and trusted package repositories. The malware also contained geo-aware logic, including a destructive branch that could trigger system wiping on hosts appearing to be in Israel or Iran, while avoiding Russian-language systems. Microsoft urged defenders to isolate affected Linux hosts, block outbound connections to the malicious infrastructure, hunt for indicators including `/tmp/transformers.pyz`, `pgmonitor.py`, and `pgsql-monitor.service`, and rotate any credentials that may have been exposed.
Jun 29, 2026