Popular Python AI library hacked to deliver malware

Red padlock open on electric circuits network dark red background

(Image credit: Shutterstock/Chor muang)

A PyPI package for an AI model was compromised and used to deliver malware
Victims were getting XMRig, a popular cryptominer, installed
The attack has since been addressed, but users warned to be on their guard

Ultralytics YOLO11, an AI model for computer vision and object detection, was compromised in an apparent supply chain attack, and used to deploy malware on victim devices.

The attack was confirmed by the company’s founder, who also said the incident was remedied, and the malicious version pulled - however, it seems that new malicious versions have popped up again.

YOLO11 (short for You Only Look Once), is an AI model designed for real-time computer vision tasks, such as identifying objects, analyzing images, and detecting poses. The service is quite popular, being starred more than 30,000 times, forked on GitHub more than 6,000 times, and counts hundreds of thousands of downloads a day.

Newer attacks

As an open source solution, YOLO11 was also available for download on PyPI, one of the world’s biggest Python package repositories.

There, an unidentified threat actor recently broke into the account and uploaded two versions - 8.3.41, and 8.3.42. Those who updated to these versions, either directly or through a dependency, ended up with a cryptocurrency miner on their devices.

The miner installed is called XMRig, and it is by far the most popular cryptojacker (a “hijacker” malware that mines crypto) out there. XMRig is known for generating Monero (XMR), a privacy-oriented currency that is difficult to trace.

Ultralytics founder and CEO Glenn Jocher confirmed the attack, and said it was addressed: "We confirm that Ultralytics versions 8.3.41 and 8.3.42 were compromised by a malicious code injection targeting cryptocurrency mining. Both versions have been immediately removed from PyPI," Jocher posted to GitHub. "We have released 8.3.43 which addresses this security issue. Our team is conducting a full security audit and implementing additional safeguards to prevent similar incidents."

However, over the weekend BleepingComputer said there were user reports of even newer versions - 8.3.45, and 8.3.46, who were “trojanized”. At press time, GitHub shows 8.3.48 as the newest version.

Via BleepingComputer

PyPI stops signing up new users to try and block malware campaign
Here's a list of the best antivirus
These are the best endpoint protection tools right now

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.