Post

Matt Keeter
@mattkeeter.com

(someone used a carefully crafted branch name to inject a crypto miner into a popular Python package: github.com/ultralytics/...)

github.comDiscrepancy between what's in GitHub and what's been published to PyPI for v8.3.41 · Issue #18027 · ultralytics/ultralyticsBug Code in the published wheel 8.3.41 is not what's in GitHub and appears to invoke mining. Users of ultralytics who install 8.3.41 will unknowingly execute an xmrig miner. Examining the file util...

55 reposts243 likes

Nafnlaus 🇮🇸🇪🇺🇺🇦
@nafnlaus.bsky.social

What's maddening to me is that Git constantly wastes my time with layer after layer of overaggressive security features that only gets in the way of my ability to actually accomplish things... ... and then they're just parsing user-provided URLs ***in the shell***? What the heck, Github?

Nate Keating
@natekeating.bsky.social

And it was the Colab team that found the exploit and reported it in the GitHub issue you linked! github.com/googlecolab/... Major credit to the team; nasty exploit that hit us too

github.comColab Account Access Blocked due to "suspected abusive activity" · Issue #4979 · googlecolab/colabtoolsFor the last few days, I've been running two different machine learning tasks, for two projects I have due in the next few days. One was a notebook fine tuning a reinforcement learning agent I've b...