Ultralytics' PyPI Build Was Hijacked to Ship a Cryptominer
On this page
The repo was clean; the release wasn't. The compromise lived in the build pipeline.
| When | December 2024 |
|---|---|
| Target | ultralytics (YOLO) Python package |
| Vendor | Ultralytics; PyPI |
| Technique | CI/CD compromise (Actions script injection) + stolen token |
| Impact | Cryptominer shipped to a package with tens of millions of downloads |
- 1Attackers exploit a GitHub Actions script-injection flaw to poison the build cache
- 2Trojanised ultralytics releases are published to PyPI (later via a stolen token)
- 3Installers run an XMRig cryptominer on victims' machines
What happened
In December 2024, attackers poisoned the build pipeline of the popular ultralytics package and pushed trojanised releases to PyPI that downloaded and ran the XMRig Monero cryptominer. The initial compromise abused a GitHub Actions script-injection flaw (a crafted branch name in a draft PR) that poisoned the cached build workflow, injecting code after review; later versions used a stolen PyPI token.
How the attack worked
The malicious code never appeared in a reviewed commit — it was injected into the build workflow itself, so a clean-looking source tree produced a trojanised artifact.
Root cause
An insecure CI/CD pipeline (unsafe use of untrusted input in GitHub Actions) plus weak publish-token handling — the release path, not the code, was the attack surface.
What a control would have caught
Hardening Actions against script injection, pinning workflows, and requiring trusted-publishing with short-lived tokens closes the exact gaps abused here.
How to prevent it
- Secure the build pipeline, not just the repo — treat CI as production.
- Never interpolate untrusted input into Actions scripts.
- Use trusted publishing / short-lived tokens and verify release provenance.
Feel it yourselfThe replay lab tampers with a package's post-install step — the build/dependency supply-chain class.
FAQ
How was a trusted package trojanised?
The initial compromise abused a GitHub Actions script-injection flaw (a crafted branch name in a draft PR) that poisoned the cached build workflow, injecting code after review; later versions used a stolen PyPI token.
What was the payload?
The malicious versions downloaded and ran the XMRig Monero cryptominer; some Google Colab users who installed it were banned for “abusive activity.”
Why does the CI/CD angle matter?
The source code looked clean — the compromise was in the build pipeline. Securing the release pipeline (not just the repo) is essential for any widely-used AI library.
Sources
- Ultralytics Python Package Compromise Deploys Cryptominer — HiddenLayer
- Ultralytics AI Library Compromised: Cryptocurrency Miner Found in PyPI Versions — The Hacker News
- Ultralytics AI model hijacked to infect thousands with cryptominer — BleepingComputer