Popular Python Package Becomes Crypto Miner

A widely used Python vision library, Ultralytics, was compromised through its GitHub Actions pipeline and used to publish multiple malicious PyPI releases containing a crypto miner and credential-stealing behavior. The key impact: attackers didn’t need to break into every downstream user’s machine directly—poisoned CI/CD steps and package distribution channels pushed harmful code to PyPI, where it was available to users for roughly 13 hours before takedowns.

The incident began with an exploitation of Ultralytics’ CI workflow. An attacker used a pull request workflow to gain privileged execution in the “pull_request_target” context, then combined that with a template injection in a composite GitHub Action. That injection allowed untrusted branch names to be expanded into a shell context without proper escaping, enabling the attacker to run arbitrary code with the permissions of a normal privileged workflow. From there, the attacker pivoted to compromising the PyPI publishing process.

Once code execution was achieved in the CI environment, the attacker appears to have used stolen API credentials to publish a malicious package version (first identified as 8341) directly to PyPI. The release process was “trusted publishing,” meaning PyPI publishing was automatically authorized by the CI workflow without additional manual sign-offs or extra deployment protections. That automation removed friction: once the workflow was compromised, a publish event could fire immediately.

Investigators also found evidence consistent with “cache poisoning.” Ultralytics’ CI likely pulled dependencies through cached artifacts, and those caches were tampered with so that subsequent builds would retrieve malicious packages under legitimate names. Additional clues pointed to poisoning of the pip cache server URL as well, strengthening the case that the attacker redirected dependency resolution to a malicious registry while keeping the expected package identifiers.

The attacker’s activity didn’t stop at the first release. Within about 36 hours, two more malicious versions (45 and 46) were pushed to PyPI and later deleted. Transparency logs and action logs showed the malicious releases were triggered by pushes to the main branch, and the attacker removed an “actor check” that previously restricted who could publish the YAML workflow—effectively widening who could trigger the publishing pipeline.

Beyond the miner, analysis of payload artifacts suggested token theft and exfiltration. The malicious scripts searched for secrets (including GitHub tokens), base64-encoded results, and exfiltrated them to external endpoints. Investigators also traced related attacker infrastructure to deleted GitHub identities and gists, including experimentation with similar template-injection techniques in earlier attempts. A static analysis tool for GitHub Actions (referred to as zizmor) flagged key insecure patterns in the exploit chain—especially unsafe trigger configuration and template injection patterns—though it had not yet audited composite-action template injection in the specific Ultralytics action at the time.

Overall, the incident underscores how a single CI/CD weakness—especially one involving pull_request_target plus unsafe templating—can cascade into supply-chain compromise. It also highlights why automated trusted publishing and dependency caching can turn a CI breach into a fast-moving distribution attack, leaving downstream users exposed until the malicious versions are removed.