Discrepancy between what's in GitHub and what's been published to PyPI for v8.3.41 · Issue #18027 · ultralytics/ultralytics
github.com
Bug Code in the published wheel 8.3.41 is not what's in GitHub and appears to invoke mining. Users of ultralytics who install 8.3.41 will unknowingly execute an xmrig miner. Examining the file util...
  • FizzyOrange
    16·
    6 days ago

    Where’s the code that doesn’t quote this properly? I’m guessing it’s Bash.

    • Thinker@lemmy.world
      19·
      6 days ago

      Ding ding ding! We have a winner!

      It’s a third-party GitHub Action that is passing the branch name directly to Bash. So to be clear, not GitHub’s fault.