Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Incident overview
PyPI confirms malicious Ultralytics releases following compromise of GitHub Actions workflows and a publishing token, with affected releases removed.
Why this analysis has no ERS
PyPI confirmed malicious ultralytics releases and Colab/ComfyUI confirmed AI workflow exposure, but no one fixed deployment reports a pre-execution artifact admission policy, provenance checks, or sufficient UAAR/SVR/SLIR evidence for a full Ro-5 anchor. Later Colab abuse detection held; the missing admission inputs remain unknown.
Status: Not scorable by design · Classification: Incident · source date 2024-12-11
AIDEFEND evidence routes
No AIDEFEND control evidence is assigned to this record.