PyTorch-nightly torchtriton dependency compromise (Incident)

PyTorch-nightly packages installed via pip between December 25–30, 2022 pulled a malicious dependency ('torchtriton') introduced through dependency confusion; that dependency installed a binary which collected system information and files and exfiltrated them via encrypted DNS queries to *.h4ck.cfd, and the package author later claimed no malicious intent and deleted the collected data.