Case ultralytics-pypi-cryptominingAI supply chainWorldwide
Ultralytics AI library hacked via GitHub Actions to push cryptominer on PyPI
A supply chain attack on Ultralytics exploited GitHub Actions to inject malicious PyPI packages used for cryptomining.
HighAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Dec 4, 2024
- Location
- Worldwide
- Target
- Ultralytics AI library (PyPI users)
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
A supply chain attack on Ultralytics exploited GitHub Actions to inject malicious PyPI packages used for cryptomining.
Impact: Malicious Ultralytics packages were published to PyPI to run cryptominers on installing systems; number of victims not stated.
Who triggered it
Actor: Unknown
Attribution: Not stated in the summary.
Motive: Cryptomining
How it happened
Attack vector: Exploitation of GitHub Actions to inject malicious packages into the PyPI release of the Ultralytics library.
Root cause: Weakness in the project's GitHub Actions workflow allowed malicious code injection into published packages.
Timeline
- Reported by Wiz Research
Response
Wiz published an account of how it unfolded and mitigation steps for users.
Current status: Contained
Sources (open in a new tab)
- Wiz Research wiz.io
Cite this case
Ultralytics AI library hacked via GitHub Actions to push cryptominer on PyPI. AI Threat Watch, case ultralytics-pypi-cryptomining, Dec 4, 2024. https://aithreat.io/cases/ultralytics-pypi-cryptomining/
Permanent link: https://aithreat.io/cases/ultralytics-pypi-cryptomining/