lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping)
lightning PyPI Package Compromise (TL-2026-0444), also tracked as lightning 2.6.2/2.6.3 compromise, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-04-30. It is attributed to TeamPCP with high confidence, affects Lightning AI lightning (PyPI), maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-0444
- Threat ID
- TL-2026-0444
- Also known as
- lightning 2.6.2/2.6.3 compromise, PyTorch Lightning supply chain compromise, pl-ghost incident
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-04-30
- Last reviewed
- 2026-04-30
- Attribution
- TeamPCP
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- technology, artificial-intelligence, machine-learning, academia, research, financial-services, healthcare, media, cloud-providers, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in lightning PyPI Package Compromise
Malware and tooling: Shai-Hulud-overlap stealer/worm, Bun v1.3.13, GitHub-API-based bidirectional C2
PyTorch Lightning's flagship PyPI package 'lightning' was compromised on 2026-04-30 with malicious versions 2.6.2 and 2.6.3. A hidden _runtime/start.py spawned by __init__.py downloads Bun v1.3.13 from GitHub and executes an 11.4 MB obfuscated router_runtime.js that exfiltrates GitHub/npm tokens, AWS/Azure/GCP cloud credentials, .env files and browser secrets, and abuses GitHub APIs to commit encoded data to victim repositories. Tradecraft (worming via npm tarball infection, repo poisoning, GitHub-as-C2) overlaps the Shai-Hulud campaign; the GitHub account 'pl-ghost' that closed the disclosure issue suggests maintainer account compromise.
How lightning PyPI Package Compromise works
On 2026-04-30, the popular PyPI package 'lightning' (PyTorch Lightning, the high-level deep learning framework with hundreds of thousands of daily downloads) was published in compromised form as versions 2.6.2 and 2.6.3, both 'py3-none-any' wheels containing a hidden credential-stealing payload that executes silently on every 'import lightning'.
The execution chain is three stages. First, the package __init__.py spawns a daemon thread that calls subprocess.Popen on lightning/_runtime/start.py with stdout and stderr redirected to DEVNULL, so the malicious activity produces no console artifacts. Second, start.py downloads the Bun v1.3.13 JavaScript runtime from GitHub release artifacts (oven-sh/bun) and stages it locally. Third, the staged Bun binary executes lightning/_runtime/router_runtime.js, an 11,448,921-byte heavily obfuscated payload (SHA256 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1). Both the wheel's MANIFEST.in and RECORD file list these files with matching hashes, confirming the malicious files were built into the published wheel rather than added through a local modification.
String analysis of router_runtime.js reveals the operator's intent: 373 references to '.env' (dotenv harvesting), 703+ references to 'process'/'env', 463+ references to tokens/auth, 336+ references to repositories, 52 'exec' and 14 'child_process' references (arbitrary command execution), and explicit references to 'chrome', 'firefox', and 'brave' (browser secret theft). Embedded URLs target the AWS Instance Metadata Service at 169.254.169.254 (IAM role credential theft from EC2/ECS), AWS STS / Secrets Manager / SSM, Azure AD OAuth at login.microsoftonline.com plus vault.azure.net, GCP OAuth / Secret Manager / Cloud KMS, the GitHub REST API (/user, /search/commits), and the public npm registry.
GitHub is used as both an exfiltration channel and a propagation channel. The payload uses stolen GitHub tokens to commit base64-encoded victim data into attacker-controlled or victim-controlled repositories — the same dead-drop tradecraft used by the Shai-Hulud worm in the npm ecosystem in 2025. The payload also enumerates developer npm packages and is capable of injecting itself into outbound npm tarballs, giving the attack a worming capability that turns each compromised developer machine into a launchpad for the next set of compromised packages.
The disclosure timeline strongly suggests maintainer account compromise rather than a build-system breach. Socket's static analysis flagged 2.6.2 within 18 minutes of publication. A community member opened Lightning-AI/pytorch-lightning issue #21689 at 2026-04-30T13:13:57Z with a complete proof of compromise. A GitHub account named 'pl-ghost' closed the issue 13 minutes later at 13:27:00Z without engaging with the technical evidence. Project staff (ethanwharris) were subscribed at 13:14:38Z but did not respond before the close. A subsequent comment was deleted by the Lightning-AI organization at 14:11:54Z. The 'pl-ghost' account's ability to close an issue on the official repository, combined with the 'pl' (PyTorch Lightning) prefix mimicking maintainer naming, points to a hijacked or impersonating account with at least triage permissions on the repository.
Impact is severe and broad. Any environment that ran 'import lightning' against 2.6.2 or 2.6.3 — including developer laptops, Jupyter / Colab / Kaggle notebooks, Lightning Studios, ML training jobs in CI/CD, AWS SageMaker / Vertex AI / Azure ML pipelines, and self-hosted GPU clusters — must be treated as having had its environment variables, .env files, GitHub/npm tokens, browser-stored credentials, and any ambient cloud-IAM credentials reachable via IMDS exfiltrated. Because GitHub tokens were a primary target and the payload commits to repositories, downstream supply-chain compromise of any project where a lightning user holds push access is plausible. Defenders should yank 2.6.2 and 2.6.3, downgrade to 2.6.1 (clean, published 2026-01-30), rotate all credentials reachable from any environment that imported the malicious versions, audit GitHub commits and npm publishes from those identities since 2026-04-30, and search for the specific file paths lightning/_runtime/start.py and lightning/_runtime/router_runtime.js in installed Python environments.
MITRE ATT&CK techniques used in TL-2026-0444
Collection
T1005 Data from Local System; T1530 Data from Cloud Storage
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1564.001 Hide Artifacts: Hidden Files and Directories
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567.002 Exfiltration to Cloud Storage
Execution
T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.003 Malicious Image
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer
Discovery
T1083 File and Directory Discovery; T1526 Cloud Service Discovery
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Unsecured Credentials: Credentials in Files; T1552.005 Cloud Instance Metadata API; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Impact
stealth
Affected products and versions in lightning PyPI Package Compromise
- Lightning AI — lightning (PyPI)
Vulnerable versions: 2.6.2; 2.6.3
Fixed in: 2.6.1 (last known clean) - PyPI — lightning wheel (py3-none-any)
Vulnerable versions: 2.6.2-py3-none-any.whl; 2.6.3-py3-none-any.whl
Remediation for lightning PyPI Package Compromise
Patches
- Downgrade: pip install --force-reinstall 'lightning==2.6.1'
- Await an official Lightning AI advisory and a re-released clean 2.6.x; do not upgrade until provenance is verifiable.
Immediate actions
- Pin lightning to 2.6.1 (published 2026-01-30) or earlier; refuse 2.6.2 and 2.6.3 in pip resolver via --constraint or pip-audit policy.
- Search every developer machine, CI runner, and notebook environment for the files lightning/_runtime/start.py and lightning/_runtime/router_runtime.js — presence indicates execution.
- Treat any environment that ran 'import lightning' against 2.6.2 or 2.6.3 as fully compromised: exfiltration includes env vars, .env files, browser stored credentials, GitHub/npm tokens, and IMDS-derived cloud-IAM credentials.
- Rotate every GitHub personal access token, fine-grained PAT, GitHub App installation token, and OAuth grant accessible from compromised environments.
- Rotate npm publish tokens and audit recent npm publish events for tampered tarballs.
- Rotate AWS access keys, force IAM Role session revocation (aws iam delete-access-key + sts revoke-session), and rotate Azure AD service principal secrets and GCP service account keys for any cloud identity reachable via IMDS or environment variables.
- Audit GitHub repositories that compromised identities can push to for unauthorized commits dated 2026-04-30 or later, especially commits with base64-looking blobs or unusual file additions.
Workarounds
- If lightning cannot be removed immediately, run training jobs in network-isolated containers with no GitHub/npm/cloud-API egress and no mounted credentials.
- Use a static-analysis hook (e.g., Socket, pip-audit, ossf/scorecard) in pre-install to block packages that ship a _runtime/ subdirectory containing start.py.
Longer-term hardening
- Adopt a private PyPI proxy with pre-publish allowlisting and integrity attestation (PEP 740 / Sigstore) for high-risk dependencies.
- Block outbound network egress from build/CI environments to GitHub release-asset CDNs and oven-sh/bun unless explicitly required.
- Move CI cloud credentials away from long-lived static keys to short-lived OIDC federation tokens scoped per workflow.
- Disable IMDSv1 and require IMDSv2 hop-limit=1 on EC2 instances to reduce blast radius of in-process credential theft.
- Add EDR file-integrity monitoring on site-packages/lightning and equivalent ML library directories.
- Adopt SLSA Level 3+ build provenance verification for Python wheels in dependency-resolution policy.
Weaknesses (CWE) in lightning PyPI Package Compromise
CWE-506, CWE-829, CWE-494, CWE-507, CWE-522, CWE-798
Timeline of lightning PyPI Package Compromise
- lightning 2.6.1 published to PyPI — last known clean release.
- Threadlinqs Intelligence publishes TL-2026-0444 with full IOC set, MITRE mapping, and detection coverage.
- Socket Security publishes detailed write-up linking tradecraft to Shai-Hulud-style npm tarball worming and GitHub-as-C2 exfil.
- Lightning AI staff (ethanwharris) subscribed to issue at 13:14:38Z; an organization-deleted comment occurred at 14:11:54Z.
- GitHub account 'pl-ghost' closed issue #21689 at 13:27:00Z (~13 minutes after opening) without addressing the technical evidence.
- GitHub issue Lightning-AI/pytorch-lightning#21689 opened at 13:13:57Z with full reproduction steps and string analysis of router_runtime.js.
- lightning 2.6.3 published to PyPI with the same execution chain — confirms the compromise was not a single-shot mistake.
- Socket's static-analysis AI flagged 2.6.2 as malicious within 18 minutes of publication.
- Malicious lightning 2.6.2 published to PyPI as py3-none-any wheel containing lightning/_runtime/start.py and lightning/_runtime/router_runtime.js.
- As of 2026-05-29, the specific lightning 2.6.2/2.6.3 wheels were quarantined from PyPI within ~42 min of the 2026-04-30 publish (CVE-2026-44484; pin 2.6.1), so the delivery vector is contained. But the TeamPCP/Mini Shai-Hulud operator and worming tradecraft remain highly active, with 400+ and 639-package waves on May 11 and 19, plus unrotated stolen credentials still at risk.
Sources cited for lightning PyPI Package Compromise
- lightning PyPI Package Compromised in Supply Chain Attack
- router_runtime.js — malicious payload (Socket package viewer)
- Lightning-AI/pytorch-lightning issue #21689 — Possible supply chain attack on version 2.6.3
- PyTorch Lightning project (Lightning-AI/pytorch-lightning)
- PyPI release page — lightning
- Bun v1.3.13 release (downloaded by malicious start.py)
- Shai-Hulud npm worm — original campaign reference
Threats related to lightning PyPI Package Compromise
- Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
- Miasma Worm Compromises 73 Microsoft GitHub Repositories Across Azure, Azure-Samples, Microsoft & MicrosoftDocs — Self-Replicating Mini Shai-Hulud Variant Weaponizing AI Coding Agents (TeamPCP)
- Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (Shai-Hulud / Mini Shai-Hulud Variant)
- Mini Shai-Hulud v3 — TanStack/UiPath/Mistral AI npm & PyPI Supply Chain Compromise (TeamPCP)
- SAP CAP & Cloud MTA npm Packages Compromised — Mini Shai-Hulud (TeamPCP) Bun-Based Credential Stealer
- Nx Console VS Code Extension Backdoored (v18.95.0) — TeamPCP Mini Shai-Hulud Pivot from TanStack npm Worm to GitHub Internal Repository Breach (CVE-2026-48027)
Detection coverage for TL-2026-0444
As of 2026-04-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0444 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.