2026-04-30 00:00
← BackIn yet another software supply chain attack, threat actors have managed to compromise the popular Python packageLightningto push two malicious versions to conduct credential theft. According toAikido Security,OX Security,Socket, andStepSecurity, the two malicious versions are versions 2.6.2 and 2.6.3, both of which were published on April 30, 2026. The campaign is assessed to be an extension of theMini Shai-Hulud supply chain incidentthat targetedSAP-related npm packageson Wednesday. As of writing, the project has been quarantined by the administrators of the Python Package Index (PyPI) repository. PyTorch Lightning is anopen-source Python frameworkthat provides a high-level interface for PyTorch. The open-source project has more than 31,100 stars on GitHub. "The malicious package includes a hidden _runtime directory containing a downloader and an obfuscated JavaScript payload," Socket said. "The execution chain runs automatically when the lightning module is imported, requiring no additional user action after installation and import." The attack chain paves the way for a Python script ("start.py"), which downloads and executes the Bun JavaScript runtime, and then uses it to run an 11MB obfuscated malicious payload ("router_runtime.js") with an aimto conduct comprehensive credential theft.
From among the harvested credentials, the GitHub tokens are validated against the "api.github[.]com/user" endpoint before being used to inject a worm-like payload to up to 50 branches...
In yet another software supply chain attack, threat actors have managed to compromise the popular Python packageLightningto push two malicious versions to conduct credential theft. According toAikido Security,OX Security,Socket, andStepSecurity, the two malicious versions are versions 2.6.2 and 2.6.3, both of which were published on April 30, 2026. The campaign is assessed to be an extension of theMini Shai-Hulud supply chain incidentthat targetedSAP-related npm packageson Wednesday. As of writing, the project has been quarantined by the administrators of the Python Package Index (PyPI) repository. PyTorch Lightning is anopen-source Python frameworkthat provides a high-level interface for PyTorch. The open-source project has more than 31,100 stars on GitHub. "The malicious package includes a hidden _runtime directory containing a downloader and an obfuscated JavaScript payload," Socket said. "The execution chain runs automatically when the lightning module is imported, requiring no additional user action after installation and import." The attack chain paves the way for a Python script ("start.py"), which downloads and executes the Bun JavaScript runtime, and then uses it to run an 11MB obfuscated malicious payload ("router_runtime.js") with an aimto conduct comprehensive credential theft.
From among the harvested credentials, the GitHub tokens are validated against the "api.github[.]com/user" endpoint before being used to inject a worm-like payload to up to 50 branches retrieved from every repository the token can write to. "The operation is an upsert: it creates files that do not yet exist and silently overwrites files that do," Socket added. "No pre-check for existing content is performed. Every poisoned commit is authored using a hardcoded identity designed to impersonate Anthropic's Claude Code." Separately, the malware implements an npm-based propagation vector that modifies the developer's local npm packages with a postinstall hook in the "package.json" file to invoke the malicious payload, increases the patch version number, and repacks the .tgz tarballs. Should the unsuspecting developer publish the tampered packages from their local environment, they are made available on npm, from where the malware ends up on downstream user systems. The maintainers of the project haveacknowledgedthat "we are aware of the issue and are actively investigating." It's currently not clear how the incident occurred, but indications are that the project's GitHub account has been compromised. In aseparate advisory, Lightning revealed an investigation is still underway to determine the exact root cause of the compromise and that the "affected versions have introduced functionality consistent with a credential harvesting mechanism." In the interim, it's advised to block Lightning versions 2.6.2 and 2.6.3 and remove them from developer systems, if already installed. It's also essential to downgrade to the last known clean version, 2.6.1, and rotate credentials exposed in affected environments.
The supply chain attack is the latest addition to a long list of compromises carried out by a threat actor known as TeamPCP, which has now launched an onion website on the dark web after its account wassuspended from Xfor violating the platform's rules. It also calledLAPSUS$, a "good partner of ours and has been involved heavily throughout this entire operation." The group also made it a point to emphasize that it has "never used VECT encryption tools and we own CipherForce, our own private locker," following areport from Check Point Researchabout vulnerabilities discovered in the ransomware's encryption process. In a related development, it has emerged that version 7.0.4 ofintercom-clienthas been compromised as part of the Mini Shai-Hulud campaign, following a similar modus operandi as that of theSAP packagesto trigger the execution of a credential-stealing malware using a preinstall hook. "The overlap is significant because the SAP CAP campaign was linked to TeamPCP activity based on shared technical details, including distinctive payload implementation patterns, GitHub-based exfiltration, credential harvesting across developer and CI/CD environments, and similarities to prior attacks affecting Checkmarx, Bitwarden, Telnyx, LiteLLM, and Aqua Security Trivy," Socketsaid. It has since been confirmed that the GitHub user "nhur" was hacked and that the malicious [email protected] package was published through a now-deleted branch that triggered an automated CI publish workflow.In tandem, the campaign has alsospread to Packagistwith the compromise of "intercom/intercom-php" (version 5.0.2), which adapts the same credential-stealing mechanism for the PHP ecosystem. Specifically, the package uses Composer plugin execution to download Bun by means of a shell script ("setup-intercom.sh") that's triggered duringinstall or update events(via the "post-install-cmd" and "post-update-cmd" hooks) and launches an obfuscated "router_runtime.js" credential-stealing payload. The malware component, as before, targets GitHub, npm, SSH keys, cloud credentials, Kubernetes, Vault, Docker credentials, .env files, and other developer/CI secrets. The stolen data is then encrypted and exfiltrated to a remote server ("zero.masscan[.]cloud:443/v1/telemetry").
If this primary method fails, it falls back to the GitHub-based exfiltration method using the pilfered GitHub tokens by creating a public repository with the description "A Mini Shai-Hulud has Appeared." It also comes fitted with propagation capabilities, abusing the discovered npm tokens to modify and republish packages containing the malware, in addition to writing the payload files to paths like ".claude/settings.json" and ".vscode/tasks.json." "The PHP payload mirrors the broader Mini Shai-Hulud tradecraft observed across recent npm and PyPI compromises: install-time execution, Bun-based payload launch, heavily obfuscated JavaScript, credential harvesting from developer and CI/CD environments, and encrypted exfiltration," Socket said. Intercom, for its part, has traced the root cause of the compromise to a local install of "pyannote-audio," which introduced the compromised Lightning PyPI package as a transitive dependency, offering clear evidence that the newer infections are downstream effects from prior TeamPCP waves rather than entirely independent initial access events. "That makes this especially concerning because one compromised dependency can become a bridge into additional package ecosystems," Socket told The Hacker News via email. "After two solid weeks of virtually nonstop attacks, the tempo looks deliberate and sustained rather than opportunistic. The repeated use of install-time execution, Bun-based payload delivery, obfuscated 'router_runtime.js,' credential harvesting, GitHub abuse, and package/repository propagation shows a campaign built to turn one compromised developer environment into the next package compromise." The PyPI quarantine on the Lightning package has been lifted and the malicious versions 2.6.2 and 2.6.3 have been deleted. The latest safe version is 2.6.1. (The story was updated after publication to reflect the latest developments and include additional insights from Socket.) Learn how to stop patient zero attacks before they bypass detection and compromise your systems at entry points. Learn how to validate real attack paths and reduce exploitable risk with continuous agentic security validation.
Get the latest news, expert insights, exclusive resources, and strategies from industry leaders – all for free.