Malicious Ultralytics releases reached PyPI via CI and an old token

Attackers briefly hijacked the release pipeline of Ultralytics, the publisher of the popular YOLOv5 machine learning library, and pushed malicious versions of the ultralytics package to PyPI. The compromised releases 8.3.41, 8.3.42, 8.3.45 and 8.3.46 were each available for hours before they were removed. A user noticed that the published 8.3.41 wheel did not match the GitHub source and appeared to start a cryptominer. An analysis on ENOSUCHBLOG traced the entry point to a pull_request_target workflow and a malicious branch name that a composite action expanded straight into a shell. PyPI’s analysis found no flaw in PyPI itself: the first two releases came out of the project’s own Trusted Publishing workflow, the later two were uploaded with an old API token that was never revoked. Trusted Publishing works better once you also delete the token it replaced.