The popular Ultralytics YOLO11 AI model was compromised in a supply chain attack, infecting users with a cryptominer through versions 8.3.41 and 8.3.42 hosted on the Python Package Index (PyPI). Ultralytics, a well-known developer of computer vision and AI tools, discovered that these versions included malicious code deploying the XMRig Miner, which connected to a mining pool. Affected users, particularly those on Google Colab, faced account bans for "abusive activity."
The breach impacted projects using Ultralytics as a dependency, such as SwarmUI and ComfyUI, though the malicious versions were quickly removed and replaced by a clean version 8.3.43. According to Ultralytics CEO Glenn Jocher, the compromise stemmed from two pull requests with injected code from a user in Hong Kong.
The company is investigating its build environment and implementing security measures, though it remains unclear if the attack only involved cryptomining or compromised user data. Users who installed the affected versions are advised to update immediately and conduct thorough system scans to ensure safety.
Read more...