In this case, the malicious dependency wasn't actually a dependency, so removing it from pypi caused no issues with pytorch. Not all projects are so lucky. I r

In this case, the malicious dependency wasn't actually a dependency, so removing it from pypi caused no issues with pytorch. Not all projects are so lucky. I recently wanted to contribute a feature I needed to an NPM package. The package is fairly popular (400k+ downloads per week) but is unmaintained with the last release about 3 years ago. There are no practical alternatives to this package. So my only option was to fork it. Unfortunately, one of its dependencies was found to be malware between that last release date and now. That dependency was nuked and no longer is available (not that you would install it anyways), so neither my fork nor the project can be built. The dependency tree is, of course, very complicated and it would take a lot of work to figure out a replacement for that dependency and integrate it. I ended up directly patching the last release's compiled bundle to do what I needed to do. In this case, this very useful (but unmaintained) package is now more or less dead and further development work will be very difficult, its source code a probably useless relic.