# Ultralytics PyPI releases backdoored with a crypto miner · pwn.watch

> Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.

Page: https://pwn.watch/i/ultralytics-pypi-supply-chain-attack · generated 2026-10-23T04:59:28.006Z

## Status
- Severity: high · status: closed · patch: patched
- Product: ultralytics (PyPI)
- Started: 2024-12-04 · closed: 2024-12-11
- Affected: 8.3.41; 8.3.42; 8.3.45; 8.3.46
- Fixed in: Malicious versions removed from PyPI; see vendor advisory for the clean release

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/ultralytics-pypi-supply-chain-attack/feed.xml
- JSON Feed: https://pwn.watch/i/ultralytics-pypi-supply-chain-attack/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/ultralytics-pypi-supply-chain-attack.json
- This file: https://pwn.watch/i/ultralytics-pypi-supply-chain-attack/llms.txt

## Updates (newest first)
- 2024-12-11: PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed (https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/)
- 2024-12-05: Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner (https://github.com/ultralytics/ultralytics/issues/18027)

## Fix brief
# Security brief: Ultralytics PyPI releases backdoored with a crypto miner

Source: https://pwn.watch/i/ultralytics-pypi-supply-chain-attack · status: closed (closed Dec 11, 2024) · severity: high · updated Dec 11, 2024

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.

Severity detail: Supply-chain compromise of a popular ML package

- Product: ultralytics (PyPI)

## Affected versions
- 8.3.41
- 8.3.42
- 8.3.45
- 8.3.46

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Malicious versions removed from PyPI; see vendor advisory for the clean release

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Dec 11, 2024: PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed
- Dec 5, 2024: Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner

## Write-ups & news
- [Supply-chain attack analysis: Ultralytics](https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/)
- [Discrepancy between what's in GitHub and what's been published to PyPI for v8.3.41](https://github.com/ultralytics/ultralytics/issues/18027)

---
Machine-readable: https://pwn.watch/i/ultralytics-pypi-supply-chain-attack.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.