Discrepancy between what's in GitHub and what's been published to PyPI for v8.3.41

[metrizable]

Bug

Code in the published wheel 8.3.41 is not what's in GitHub and appears to invoke mining. Users of ultralytics who install 8.3.41 will unknowingly execute an xmrig miner.

Examining the file utils/download.py, the contents in the published wheel are not representative of what's in GitHub:

$ wget -q https://files.pythonhosted.org/packages/d0/99/13d92174aa6a470d348a95e31164769f2cdf77838ea3c3e3fd476285777d/ultralytics-8.3.41-py3-none-any.whl
$ unzip -q ultralytics-8.3.41-py3-none-any.whl 
$ cat ultralytics/utils/downloads.py | sed -n "278,301p"

For the 8.3.41 tag, the content looks quite different:
https://github.com/ultralytics/ultralytics/blob/v8.3.41/ultralytics/utils/downloads.py#L278

Environment

Ultralytics 8.3.41

Minimal Reproducible Example

$ wget -q https://files.pythonhosted.org/packages/d0/99/13d92174aa6a470d348a95e31164769f2cdf77838ea3c3e3fd476285777d/ultralytics-8.3.41-py3-none-any.whl
$ unzip -q ultralytics-8.3.41-py3-none-any.whl 
$ cat ultralytics/utils/downloads.py | sed -n "278,301p"

[UltralyticsAssistant]

👋 Hello @metrizable, thank you for bringing this to our attention 🚀! We understand the importance of your report and are here to assist.

For 🐛 Bug Reports like this, we appreciate you providing the detailed steps and outputs above. A minimum reproducible example is incredibly helpful for us to investigate such issues further.

To ensure that this is not a version mismatch or environment-related issue, we recommend upgrading to the latest ultralytics version and reinstalling dependencies in a clean environment:

pip install -U ultralytics

Additionally, we encourage you to cross-check your setup with the following verified environments. If you run into inconsistencies, these can serve as alternative testing platforms:

• Notebooks with free GPU:
• Docker Image: See Docker Quickstart Guide

You can also verify the integrity of the latest release by comparing its content with the repository’s source code. Kindly let us know if the issue persists even after these verifications.

While this is an automated response 🤖, an Ultralytics engineer will review this thoroughly soon to provide further guidance. In the meantime:

• Visit our Docs for common questions and helpful resources.
• Join the Ultralytics community for real-time discussions on Discord 🎧 or dive deeper into insights on our Discourse and Subreddit.

If this badge is green, all Ultralytics CI tests are passing, verifying the correctness of our source code across platforms. If anything deviates for you, we’ll work diligently to resolve it. Thank you for your patience! 🙏

[Skillnoob]

Please uninstall v8.3.41, the package on PyPi is compromised, we are working on resolving the issue. v8.3.40 is safe to use.
ltdrdata/ComfyUI-Impact-Pack#843

To uninstall ultralytics:

pip uninstall ultralytics

You can safely install Ultralytics through the following commands:

pip install git+https://github.com/ultralytics/ultralytics.git

or:

pip install ultralytics==8.3.40

[wcc526]

github release also has the same problem https://api.github.com/repos/ultralytics/ultralytics/git/blobs/665bb8add8c21d28a961fe3f93c12b249df10787 this package is also compromised