PyPI is popular among Python programmers for sharing and downloading code. Since anyone can contribute to the repository, malware – sometimes posing as legitimate, popular code libraries – can ...

As a result, the code was present only in the package pushed to PyPI and not in the code repository on GitHub. The trojanized version of Ultralytics on PyPI (8.3.41) was published on Dec. 4.