Post

Legitimate supply-chain attack affecting Python package "Ultralytics" abused multiple levels of GitHub Actions shell injection vulnerabilities in workflows to publish malware to PyPI.