Comment Comment by shanipribadi the 3.0.0 version that is available on pypi is now an empty package with updated description ofThis is not the real torchtriton package but uploaded here to discover dependency confusion vulnerabilitiesthe compromised version is still available in pypi as version 2.0.0+0d7e753227 https://pypi.org/project/torchtriton/#history.So technically, if you are pulling the older version of pytorch-nightly (specifically 2.0.0.dev20221230), it will still pull that compromised dependency (because torch have explicit version lock to it). parent shanipribadi 3 years ago
This is not the real torchtriton package but uploaded here to discover dependency confusion vulnerabilities
the compromised version is still available in pypi as version 2.0.0+0d7e753227 https://pypi.org/project/torchtriton/#history.
So technically, if you are pulling the older version of pytorch-nightly (specifically 2.0.0.dev20221230), it will still pull that compromised dependency (because torch have explicit version lock to it).