Ultralytics PyPI Supply Chain Attack

Ultralytics YOLO AI library

Four malicious versions uploaded containing XMRig crypto miner; two-phase attack over Dec 4-7

Attacker abused git branch names to steal GitHub Actions CI/CD credentials; compromised PyPI token