Ultralytics AI Library and 'aiocpa' Python Package Compromised for Cryptocurrency Mining

Dec 7, 2024, 09:51 AM

Two versions of the popular Python AI library, Ultralytics, specifically versions 8.3.41 and 8.3.42, have been compromised to deliver cryptocurrency miners to users. The compromised packages, which include the home of yolov8 and yolo11, were found on the Python Package Index (PyPI). This breach has potentially affected thousands of users, including those using ComfyUI through the custom node ComfyUI-Impact-Pack. The incident has raised concerns over software supply chain security in the AI and machine learning community. Additionally, another Python package, 'aiocpa', was exposed as a cryptocurrency infostealer.