Ultralytics: a hijacked GitHub Actions pipeline used to mine cryptocurrency

2024-12-04 · Publisher : Ultralytics · Domain : Cloud & DevOps

From 4 to 7 December 2024, four versions of the Python package ultralytics are published on PyPI carrying a cryptocurrency miner. The attacker exploited a GitHub Actions workflow flaw, then a forgotten PyPI token.

### Background On 4 December 2024, version 8.3.41 of the Python package ultralytics (a computer vision library) is published on PyPI. It carries an XMRig cryptocurrency miner. Three more versions follow: 8.3.42 on 5 December, then 8.3.45 and 8.3.46 on 7 December. PyPI removes them and publishes an analysis on 11 December. ### Key facts - Initial vector: a workflow triggered by pull_request_target that injected the branch name unsafely into a shell command, allowing code execution (template injection). - The malicious code was planted in the build-phase cache, then included in packages published by the legitimate workflow (versions 8.3.41 and 8.3.42). - Versions 8.3.45 and 8.3.46 were published using a PyPI API token that was still active, probably predating the move to trusted publishing. - Sigstore transparency logs and provenance attestations made it possible to trace the attack. - According to the author of the zizmor audit tool, it would have flagged the dangerous trigger and the injection. ### Why it matters This is a direct attack on the pipeline, not on the source code: an outside contributor gets code execution inside the CI of a widely used project. It illustrates three basic rules for DevOps teams: be wary of pull_request_target, never interpolate controllable input into commands, and revoke old tokens once trusted publishing is in place. The project was already using trusted publishing, which made the investigation easier. ### Takeaway A textbook case of GitHub Actions workflow security, foreshadowing the attacks of 2025 and 2026.

Tags : Sécurité, CI/CD, DevOps, Open Source