Compromised ultralytics PyPI package delivers crypto coinminer

On Dec 4 a malicious 8.3.41 release of the popular ultralytics Python package was published to GitHub and PyPI after attackers exploited a known GitHub Actions script-injection vulnerability in the project's build pipeline; the injected code downloaded an XMRig coinminer and subsequent malicious releases were likely published using a stolen PyPI API token, affecting multiple versions and posing risk to the package's large user base (≈60M downloads), though a clean 8.3.43 release was later published.