How We Executed a Critical Supply Chain Attack on PyTorch

How We Executed a Critical Supply Chain Attack on PyTorch

Report on a now handled supply chain attack reported against PyTorch which took advantage of GitHub Actions, stealing credentials from some self-hosted task runners.

The researchers first submitted a typo fix to the PyTorch repo, which gave them status as a "contributor" to that repo and meant that their future pull requests would have workflows executed without needing manual approval.

Their mitigation suggestion is to switch the option from 'Require …

github pytorch report researchers security self-hosted stealing supply chain them