Ultralytics AI Library Hacked via GitHub for Cryptomining

Security researchers found that PyPI versions 8.3.41 and 8.3.42 of the Ultralytics Python package were backdoored via a GitHub Actions CI/CD vulnerability that allowed attackers to inject an XMRig cryptominer into release artifacts; the malicious versions were published to PyPI (affecting downstream projects like ComfyUI), subsequently removed, and users are advised to uninstall the affected packages and remediate any infected systems.