- A PyPI package for an AI model was compromised and used to deliver malware
- The victims were installing XMRig, a popular crypto miner
- The attack has since been addressed, but users were warned to be on their guard.
Ultralytics YOLO11, an artificial intelligence model for computer vision and object detection, was compromised in an apparent supply chain attack and used to deploy malware on victims' devices.
The attack was confirmed by the company's founder, who also said that the incident was fixed and the malicious version was removed; However, it seems that new malicious versions have reappeared.
YOLO11 (short for You Only Look Once) is an AI model designed for real-time computer vision tasks such as identifying objects, analyzing images, and detecting poses. The service is quite popular, having been featured over 30,000 times, forked on GitHub over 6,000 times, and has hundreds of thousands of downloads a day.
Newer attacks
There, an unidentified threat actor recently broke into the account and uploaded two versions: 8.3.41 and 8.3.42. Those who upgraded to these versions, either directly or through a dependency, ended up with a cryptocurrency miner on their devices.
The installed miner is called XMRig and is by far the most popular cryptojacker out there. XMRig is known for generating Monero (XMR), a privacy-oriented currency that is difficult to trace.
Ultralytics founder and CEO Glenn Jocher confirmed the attack and said it had been fixed: “We confirm that Ultralytics versions 8.3.41 and 8.3.42 were compromised by a malicious code injection targeting cryptocurrency mining .Both versions were immediately removed from PyPI.” Jocher posted on GitHub. “We have released version 8.3.43 which addresses this security issue. Our team is conducting a full security audit and implementing additional security measures to prevent similar incidents.”
However, over the weekend beepcomputer said there were reports from users of even newer versions: 8.3.45 and 8.3.46, which were “trojanized.” At the time of this post, GitHub shows 8.3.48 as the newest version.
Through beepcomputer