4 ms·
> Ultralytics tools are open-source and are used by numerous projects spanning a wide range of industries and applications. Open source and popular doesn't nec
by aucisson_masque 2y ago
> Ultralytics tools are open-source and are used by numerous projects spanning a wide range of industries and applications.
Open source and popular doesn't necessarily mean safe.
Technically you can read the code source but no one does that and especially for each update.
- smarx007 2y agoThe vulnerability was not in the source code of the repo. See https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-injection https://blog.yossarian.net/2024/12/06/zizmor-ultralytics-inj... for a deeper analysis - a great read!
- lostmsu 2y agoIt was. The vulnerability is the use of `pull_request_target` on a workflow that has access to secrets.
- smarx007 2y agoYou are right, my choice of words was poor. The vuln is exactly as you describe, and it's the malicious payload that was not in the codebase (cache poisoning which is not detectable by reviewing the code of the repo).
- ashishbijlani 2y agoThis is exactly why I'm building Packj audit [1]. It detects malicious PyPI/NPM/Ruby/PHP/etc. dependencies using behavioral analysis. It uses static+dynamic code analysis to scan for indicators of compromise (e.g., spawning of shell, use of SSH keys, network communication, use of decode+eval, etc). It also checks for several metadata attributes to detect bad actors (e.g., typo squatting). 1. https://github.com/ossillate-inc/packj https://github.com/ossillate-inc/packj