CYB-004 Ultralytics releases on PyPI compromised through its GitHub Actions workflows and PyPI token, per PyPI

ID: CYB-004
Category: Cyber Cyber incident linked to an AI incident
Disclosed: 2024-12
Systems: ultralytics package on PyPI (8.3.41, 8.3.42, 8.3.45, 8.3.46)
Harm type: Supply chain / release compromise
Status: reported
PyPI, the package registry, published the analysis and removed the affected versions. PyPI is not the project's maintainer, so "reported" is the closest existing status value.
CISA KEV: Not applicable: no CVE is cited for this incident
Vendor: Ultralytics
Product: ultralytics (PyPI)

Summary

PyPI's analysis says Ultralytics releases 8.3.41, 8.3.42, 8.3.45 and 8.3.46 were affected after the project's GitHub Actions workflows, and subsequently its PyPI API token, were compromised. PyPI says no PyPI security flaw was used, and the affected versions were removed.

Techniques

Technique-level mapping, an editorial judgment made by the method.

T1195.002 Compromise Software Supply Chain

MITRE ATT&CK technique IDs and names: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

Not mapped. AI RMF mapping is optional for cyber incidents.

NIST SP 800-53

SR-3 Supply Chain Controls and Processes
SR-4 Provenance
SA-10 Developer Configuration Management
IA-5 Authenticator Management

Human-approval (JCR) checkpoint

not applicable

Correlated incidents

Co-occurrence, not cause: each link records something the two incidents share, as its rationale and source state. It does not say one incident caused the other. Links are written on one record; the other record shows the same link marked derived.

AI AIA-005 Malicious code shipped in Amazon Q Developer VS Code extension 1.84.0, per AWS

same technique

In both, build or publish pipeline credentials were used to ship a malicious package release: PyPI reports the Ultralytics workflows and then its PyPI API token were compromised, and AWS says an inappropriately scoped GitHub token let the actor commit code that was automatically released.

Source: aws.amazon.com https://aws.amazon.com/security/security-bulletins/AWS-2025-015/

Sources

blog.pypi.org primary link checked 2026-10-31, HTTP 200
Posted Dec 11, 2024
https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/

Corrections

No corrections recorded.

To report an error in this entry, see corrections.