https://pwn.watch/i/ultralytics-pypi-supply-chain-attack Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable. en Wed, 11 Dec 2024 00:00:00 GMT https://pwn.watch/i/ultralytics-pypi-supply-chain-attack https://pwn.watch/i/ultralytics-pypi-supply-chain-attack#2024-12-11-415b4683 Wed, 11 Dec 2024 00:00:00 GMT high <p><a href="https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/">Source</a></p> https://pwn.watch/i/ultralytics-pypi-supply-chain-attack https://pwn.watch/i/ultralytics-pypi-supply-chain-attack#2024-12-05-2a639376 Thu, 05 Dec 2024 00:00:00 GMT high <p><a href="https://github.com/ultralytics/ultralytics/issues/18027">Source</a></p>