Poisoned Pipeline / Incidents / AS13
Ultralytics PyPI compromise
In December 2024 versions of the Ultralytics Python package on PyPI were
observed shipping a cryptominer. Investigation pointed at a compromised
GitHub Actions workflow used to publish to PyPI, not at a direct PyPI
account password theft. The incident sits at the intersection of T0122
(third-party / CI action abuse), T0109 (malicious artifact), and T0139
(resource hijacking), and shows that "who can publish the package" is
often the CI identity.
Mapped techniques
- T0122 Vulnerability in third-party CI/CD actions
- T0109 Publish malicious artifact
- T0198 Malicious Build Time Dependencies
- T0159 Malicious artifact execution
- T0139 Resource hijacking
supply-chain Ultralytics CI publish path
A GitHub Actions publishing workflow was the likely injection point
for the malicious release.
Poisoned versions were uploaded to PyPI under the real project name.
The miner was introduced around the build/publish step rather than
as an obvious source-tree commit reviewers would catch.
post-supply-chain PyPI consumers
pip install ultralytics of the affected versions ran the miner.
CPU/GPU of installing hosts was used for cryptocurrency mining.