Malware in PyTorch Lightning: I Simulated the Same Supply Chain Attack Vector on My ML Dependencies in Production

Malware in PyTorch Lightning: I Simulated the Same Supply Chain Attack Vector on My ML Dependencies in Production 94% of active Python ML projects on GitHub have at least one transitive dependency without a verified hash in their requirements.txt . Yeah, you read that right. I'm not talking about abandoned 2018 repos — I'm talking about repos with commits from this week. And that completely changes how you need to think about security for any stack that touches PyPI. I found out about the PyTorc