Ultralytics Supply-Chain Attack

A malicious version (8.3.41) of the Ultralytics Python package was published to PyPI on December 4 containing downloader code that delivered the XMRig coinminer; the attackers compromised the project's build environment via a known GitHub Actions script injection. The report links to detailed analyses and PyPI guidance on mitigations such as reviewing API token usage and GitHub Trusted Publisher/Environment configurations.