Discrepancy between what's in GitHub and what's been published to PyPI for v8.3.41 · Issue #18027 · ultralytics/ultralytics
github.com
Bug Code in the published wheel 8.3.41 is not what's in GitHub and appears to invoke mining. Users of ultralytics who install 8.3.41 will unknowingly execute an xmrig miner. Examining the file util...
  • Thinker@lemmy.world
    19·
    1 month ago

    Ding ding ding! We have a winner!

    It’s a third-party GitHub Action that is passing the branch name directly to Bash. So to be clear, not GitHub’s fault.