Get the latest tech news
Analysis of supply-chain attack on Ultralytics
Analysis of a package targeted by a supply-chain attack to the build and release process
From looking at the Sigstore transparency logs and the PyPI provenance attestations, it was clear that the first set of injected packages were published through the existing GitHub Actions workflow, not by an API token. The second round of malicious releases came from the attacker using an unrevoked PyPI API token that was still available to the GitHub Actions workflow, potentially a hold-over from before the project adopted Trusted Publishing. This prevents attacks similar to xz-utils backdoor, where the malicious code was hidden in a binary archive file and therefore not easily reviewable by humans or tooling.
Or read this on Hacker News
