Supply Chain Incident
Ultralytics PyPI package compromise
The ultralytics Python project suffered a supply-chain attack through compromised GitHub Actions workflows and PyPI publishing, resulting in malicious package releases.
ConfidenceHigh
Evidence LevelVendor
Attack StageCi Cd Compromise
Source Artifact DivergenceNo
Affected Packages
Affected Releases
No structured records.
Repositories
Organizations
Maintainers
No structured records.
Threat Actors
No structured records.
Campaigns
No structured records.
Build Systems
- GitHub Actions
Distribution Channels
- PyPI
Compromised Accounts
- Ultralytics PyPI publishing token
Connected Entities
- GitHub ActionsBuild System
- PyPIDistribution Channel
- ultralyticsPackage
- UltralyticsOrganization
- Ultralytics PyPI publishing tokenCompromised Account
- ultralytics/ultralyticsRepository
References
- Supply-chain attack analysis: UltralyticsPyPI Blog · 2024-12-11