One of the last pieces of the Copilot Runtime to arrive rolled out a few weeks ago, an Arm-native version of the PyTorch machine learning framework, as part of the PyTorch 2.7 release.

PyTorch has identified a malicious dependency with the same name as the framework's 'torchtriton' library. This has led to a successful compromise via the dependency confusion attack vector.