# lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping)

> PyTorch Lightning's flagship PyPI package 'lightning' was compromised on 2026-04-30 with malicious versions 2.6.2 and 2.6.3. A hidden _runtime/start.py spawned by __init__.py downloads Bun v1.3.13 from GitHub and executes an 11.4 MB obfuscated router_runtime.js that exfiltrates GitHub/npm tokens, AWS/Azure/GCP cloud credentials, .env files and browser secrets, and abuses GitHub APIs to commit encoded data to victim repositories. Tradecraft (worming via npm tarball infection, repo poisoning, GitHub-as-C2) overlaps the Shai-Hulud campaign; the GitHub account 'pl-ghost' that closed the disclosure issue suggests maintainer account compromise.

- **Published:** 2026-04-30T12:00:00Z
- **Last reviewed:** 2026-04-30T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0444
- **ID:** TL-2026-0444
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-04-30, the popular PyPI package 'lightning' (PyTorch Lightning, the high-level deep learning framework with hundreds of thousands of daily downloads) was published in compromised form as versions 2.6.2 and 2.6.3, both 'py3-none-any' wheels containing a hidden credential-stealing payload that executes silently on every 'import lightning'.

The execution chain is three stages. First, the package __init__.py spawns a daemon thread that calls subprocess.Popen on lightning/_runtime/start.py with stdout and stderr redirected to DEVNULL, so the malicious activity produces no console artifacts. Second, start.py downloads the Bun v1.3.13 JavaScript runtime from GitHub release artifacts (oven-sh/bun) and stages it locally. Third, the staged Bun binary executes lightning/_runtime/router_runtime.js, an 11,448,921-byte heavily obfuscated payload (SHA256 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1). Both the wheel's MANIFEST.in and RECORD file list these files with matching hashes, confirming the malicious files were built into the published wheel rather than added through a local modification.

String analysis of router_runtime.js reveals the operator's intent: 373 references to '.env' (dotenv harvesting), 703+ references to 'process'/'env', 463+ references to tokens/auth, 336+ references to repositories, 52 'exec' and 14 'child_process' references (arbitrary command execution), and explicit references to 'chrome', 'firefox', and 'brave' (browser secret theft). Embedded URLs target the AWS Instance Metadata Service at 169.254.169.254 (IAM role credential theft from EC2/ECS), AWS STS / Secrets Manager / SSM, Azure AD OAuth at login.microsoftonline.com plus vault.azure.net, GCP OAuth / Secret Manager / Cloud KMS, the GitHub REST API (/user, /search/commits), and the public npm registry.

GitHub is used as both an exfiltration channel and a propagation channel. The payload uses stolen GitHub tokens to commit base64-encoded victim data into attacker-controlled or victim-controlled repositories — the same dead-drop tradecraft used by the Shai-Hulud worm in the npm ecosystem in 2025. The payload also enumerates developer npm packages and is capable of injecting itself into outbound npm tarballs, giving the attack a worming capability that turns each compromised developer machine into a launchpad for the next set of compromised packages.

The disclosure timeline strongly suggests maintainer account compromise rather than a build-system breach. Socket's static analysis flagged 2.6.2 within 18 minutes of publication. A community member opened Lightning-AI/pytorch-lightning issue #21689 at 2026-04-30T13:13:57Z with a complete proof of compromise. A GitHub account named 'pl-ghost' closed the issue 13 minutes later at 13:27:00Z without engaging with the technical evidence. Project staff (ethanwharris) were subscribed at 13:14:38Z but did not respond before the close. A subsequent comment was deleted by the Lightning-AI organization at 14:11:54Z. The 'pl-ghost' account's ability to close an issue on the official repository, combined with the 'pl' (PyTorch Lightning) prefix mimicking maintainer naming, points to a hijacked or impersonating account with at least triage permissions on the repository.

Impact is severe and broad. Any environment that ran 'import lightning' against 2.6.2 or 2.6.3 — including developer laptops, Jupyter / Colab / Kaggle notebooks, Lightning Studios, ML training jobs in CI/CD, AWS SageMaker / Vertex AI / Azure ML pipelines, and self-hosted GPU clusters — must be treated as having had its environment variables, .env files, GitHub/npm tokens, browser-stored credentials, and any ambient cloud-IAM credentials reachable via IMDS exfiltrated. Because GitHub tokens were a primary target and the payload commits to repositories, downstream supply-chain compromise of any project where a lightning user holds push access is plausible. Defenders should yank 2.6.2 and 2.6.3, downgrade to 2.6.1 (clean, published 2026-01-30), rotate all credentials reachable from any environment that imported the malicious versions, audit GitHub commits and npm publishes from those identities since 2026-04-30, and search for the specific file paths lightning/_runtime/start.py and lightning/_runtime/router_runtime.js in installed Python environments.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1195.002 Compromise Software Supply Chain
- T1195.001 Compromise Software Dependencies and Development Tools
- T1059.006 Command and Scripting Interpreter: Python
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1204.003 Malicious Image
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1070 Indicator Removal
- T1552.001 Unsecured Credentials: Credentials in Files
- T1552.005 Cloud Instance Metadata API
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1528 Steal Application Access Token
- T1526 Cloud Service Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1530 Data from Cloud Storage
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1071.001 Application Layer Protocol: Web Protocols
- T1567.002 Exfiltration to Cloud Storage
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Sources

- [lightning PyPI Package Compromised in Supply Chain Attack](https://socket.dev/blog/lightning-pypi-package-compromised)
- [router_runtime.js — malicious payload (Socket package viewer)](https://socket.dev/pypi/package/lightning/files/2.6.2/py3-none-any-whl/lightning-2.6.2/lightning/_runtime/router_runtime.js)
- [Lightning-AI/pytorch-lightning issue #21689 — Possible supply chain attack on version 2.6.3](https://github.com/Lightning-AI/pytorch-lightning/issues/21689)
- [PyTorch Lightning project (Lightning-AI/pytorch-lightning)](https://github.com/Lightning-AI/pytorch-lightning)
- [PyPI release page — lightning](https://pypi.org/project/lightning/)
- [Bun v1.3.13 release (downloaded by malicious start.py)](https://github.com/oven-sh/bun/releases/tag/bun-v1.3.13)
- [Shai-Hulud npm worm — original campaign reference](https://socket.dev/blog/shai-hulud-npm-worm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0444