Ultralytics AI Library Hacked via GitHub for Cryptomining | Wiz Blog
A supply chain attack on Ultralytics exploited GitHub Actions to inject malicious PyPI packages. Discover how it unfolded and the steps to mitigate the risk.
Security researchers have identified a supply chain attack targeting deployment versions of the Ultralytics Python package. The compromised versions, 8.3.41 and 8.3.42 , contain malicious code that executes unauthorized cryptocurrency mining software ( XMRig ) on affected machines. This compromise was limited to the PyPI-hosted versions of the package, and local or earlier versions remain unaffected. The malicious versions have since been removed from PyPI to prevent further exploitation. Ultralytics is a popular AI image prediction library with over 33k stars on GitHub and a dependency for ma
saved by
related reading
- GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blogwiz.io
- Countering misuse of AI: September 2026 / Anthropicanthropic.com
- Security incident disclosure — July 2026huggingface.co
- Hacking OpenAIhacktron.ai
- GitHub - w1b/aisi-mythos-inc-2026-07-28-01-recovered-pr: here's the evil malware Mythos made. idk... i think i could do better bro. shout out codex for slopping this out i didn't write a single line of anythinggithub.com
- Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incidentyoutube.com
- Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies | by Alex Birsan | Mediummedium.com
- OpenAI – Hugging Face Incident Technical Reportcdn.openai.com
- Training a Misaligned Reward Seekeralignment.anthropic.com
- [2608.09867] Stealing Reasoning Traces from Proprietary LLM APIsarxiv.org
- GitHub - requie/AI-Red-Teaming-Guide: A comprehensive guide to adversarial testing and security evaluation of AI systems, helping organizations identify vulnerabilities before attackers exploit them.github.com
- XZ Utils backdoor - Wikipediaen.wikipedia.org