lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping) — Threadlinqs Intelligence
As of 2026-07-02, lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping) is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-0444 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
PyTorch Lightning's flagship PyPI package 'lightning' was compromised on 2026-04-30 with malicious versions 2.6.2 and 2.6.3. A hidden _runtime/start.py spawned by __init__.py downloads Bun v1.3.13
On 2026-04-30, the popular PyPI package 'lightning' (PyTorch Lightning, the high-level deep learning framework with hundreds of thousands of daily downloads) was published in compromised form as versions 2.6.2 and 2.6.3, both 'py3-none-any' wheels containing a hidden credential-stealing payload that executes silently on every 'import lightning'.
The execution chain is three stages. First, the package __init__.py spawns a daemon thread that calls subprocess.Popen on lightning/_runtime/start.py with stdout and stderr redirected to DEVNULL, so the malicious activity produces no console artifacts. Second, start.py downloads the Bun v1.3.13 JavaScript runtime from GitHub release artifacts (oven-sh/bun) and stages it locally. Third, the staged Bun binary executes lightning/_runtime/router_runtime.js, an 11,448,921-byte heavily obfuscated payload (SHA256 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1). Both the wheel's MANIFEST.in and RECORD file list these files with matching hashes, confirming the malicious files were built into the published wheel rather than added through a local modification.
String analysis of router_runtime.js reveals the operator's intent: 373 references to '.env' (dotenv harvesting), 703+ references to 'process'/'env', 463+ references to tokens/auth, 336+ references to repositories, 52 'exec' and 14 'child_process' references (arbitrary command execution), and explicit references to 'chrome', 'firefox', and 'brave' (browser secret theft). Embedded URLs target the AWS Instance Metadata Service at 169.254.169.254 (IAM role credential theft from EC2/ECS), AWS STS / Secrets Manager / SSM, Azure AD OAuth at login.microsoftonline.com plus vault.azure.net, GCP OAuth / Secret Manager / Cloud KMS, the GitHub REST API (/user, /search/commits), and the public npm registry.
GitHub is used as both an exfiltration channel and a propagation channel. The payload uses stolen GitHub tokens to commit base64-encoded victim data into attacker-controlled or victim-controlled repositories — the same dead-drop tradecraft used by the Shai-Hulud worm in the npm ecosystem in 2025. The payload also enumerates developer npm packages and is capable of injecting itself into outbound npm tarballs, giving the attack a worming capability that turns each compromised developer machine into a launchpad for the next set of compromised packages.
The disclosure timeline strongly suggests maintainer account compromise rather than a build-system breach. Socket's static analysis flagged 2.6.2 within 18 minutes of publication. A community member opened Lightning-AI/pytorch-lightning issue #21689 at 2026-04-30T13:13:57Z with a complete proof of compromise. A GitHub account named 'pl-ghost' closed the issue 13 minutes later at 13:27:00Z without engaging with the technical evidence. Project staff (ethanwharris) were subscribed at 13:14:38Z but did not respond before the close. A subsequent comment was deleted by the Lightning-AI organization at 14:11:54Z. The 'pl-ghost' account's ability to close an issue on the official repository, combined with the 'pl' (PyTorch Lightning) prefix mimicking maintainer naming, points to a hijacked or impersonating account with at least triage permissions on the repository.
Impact is severe and broad. Any environment that ran 'import lightning' against 2.6.2 or 2.6.3 — including developer laptops, Jupyter / Colab / Kaggle notebooks, Lightning Studios, ML training jobs in CI/CD, AWS SageMaker / Vertex AI / Azure ML pipelines, and self-hosted GPU clusters — must be treated as having had its environment variables, .env files, GitHub/npm tokens, browser-stored credentials, and any ambient cloud-IAM credentials reachable via IMDS exfiltrated. Because GitHub tokens were a primary target and the payload commits to repositories, downstream supply-chain compromise of any project where a lightning user holds push access is plausible. Defenders should yank 2.6.2 and 2.6.3, downgrade to 2.6.1 (clean, published
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-507, CWE-522, CWE-798
Target sectors: technology, artificial-intelligence, machine-learning, academia, research, financial-services, healthcare, media, cloud-providers, software-development
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1195.002, T1195.001, T1059.006, T1059.007, T1204.003, T1574, T1027, T1564.001, T1070