The Ultralytics YOLO packages on PyPI were compromised through a GitHub Actions exploit, allowing attackers to inject malicious code during the automated build process.
Attackers deployed cryptocurrency mining malware via the trojanized package version 8.3.41, which was published on December 4 and went undetected at first.
Despite efforts to resolve the issue with version 8.3.42, it unintentionally included the malicious code due to a lack of understanding of the compromise source.
A clean version, 8.3.43, was ultimately published after developers were alerted, highlighting vulnerabilities in the supply chain that attackers can exploit.
Collection
[
|
...
]