As a result, the code was present only in the package pushed to PyPI and not in the code repository on GitHub. The trojanized version of Ultralytics on PyPI (8.3.41) was published on Dec. 4.