Ultralytics PyPI Releases Compromised Through GitHub Actions Workflow Attack

Summary

A crafted pull-request branch name reportedly exploited an Ultralytics GitHub Actions workflow, leading to PyPI releases 8.3.41 and 8.3.42 containing XMRig cryptomining code. The versions were removed; users are advised to uninstall and restore affected systems.

Key points

Ultralytics versions 8.3.41 and 8.3.42 on PyPI contained malicious code that downloaded and ran XMRig; the article says local or earlier versions were unaffected.
The attacker reportedly exploited unsanitized github.head_ref input in a GitHub Actions workflow triggered by pull requests, using a crafted branch name to execute code.
The article speculates that the unavailable file.sh script may have been used to modify package files that added the miner download and execution code.
A subsequent Ultralytics release was also compromised, according to the report.
The malicious versions were removed from PyPI; the article says later versions are safe to use.
Users who installed the affected versions are advised to uninstall them, restore systems to a known-clean state, and monitor for signs of cryptomining.
Wiz reports finding Ultralytics in 10% of cloud environments; ComfyUI Impact Pack was among the packages identified as potentially affected through dependency exposure.

Article Details

Attack Vectors: An attacker manipulated GitHub Actions by supplying a crafted pull-request branch name that was used as unsanitized input in the “Publish Docs” workflow, enabling arbitrary code execution.
The workflow execution was used to modify package files and publish compromised PyPI versions of Ultralytics 8.3.41 and 8.3.42 containing code to download and run XMRig for cryptocurrency mining.
Defensive Notes: Uninstall Ultralytics versions 8.3.41 and 8.3.42 and restore affected systems to a previously known clean state.
Monitor affected systems for evidence of cryptocurrency mining.
The article reports that later Ultralytics versions are safe to use and that the compromised versions were removed from PyPI.

MITRE ATT&CK

T1059.004 · Unix ShellThe crafted branch-name payload piped file.sh content into a bash session when executed by the GitHub Actions job.T1195.002 · Compromise Software Supply ChainThe attacker manipulated the release workflow to modify and publish compromised Ultralytics package versions through PyPI.T1496 · Resource HijackingThe compromised package versions contained code that ran XMRig for unauthorized cryptocurrency mining.

Malware

XMRig8.3.41 and 8.3.42, contain malicious code that executes unauthorized cryptocurrency mining software (XMRig) on affected machines. This compromise was limited to the PyPI-hosted versions of the package, and local

Products

ComfyUI Impact Packlibrary with over 33k stars on GitHub and a dependency for many packages, including the popular ComfyUI Impact Pack extension, making them vulnerable as well.GitHub Actionswhich is included in many AI packages including the ComfyUI Impact Pack. The attacker manipulated GitHub Actions by exploiting branch names in pull requests to execute arbitrary code, bundling a cryptominer into PyPIcryptocurrency mining software (XMRig) on affected machines. This compromise was limited to the PyPI-hosted versions of the package, and local or earlier versions remain unaffected. The malicious versions UltralyticsSecurity researchers have identified a supply chain attack targeting deployment versions of the Ultralytics Python package. The compromised versions, 8.3.41 and 8.3.42, contain malicious code that executes unauthorized