Shai-Hulud-themed Malware Found in PyTorch Lightning AI Training Library

Versions 2.6.2 and 2.6.3 of the PyPI package lightning were compromised by a supply chain attack on April 30, 2026.

Simply running pip install lightning activates the malicious code, with obfuscated JavaScript in a hidden _runtime directory automatically executing when the module is imported.

The main behaviors are as follows.

• Theft of credentials, authentication tokens, environment variables, and cloud secrets
• Attempts to contaminate GitHub repositories
• Exfiltration using commit messages prefixed with EveryBoiWeBuildIsAWormyBoi and public repositories

When the attacker finds npm credentials, it injects setup.mjs and router_runtime.js into the package, adds scripts.preinstall, and redistributes it. When downstream developers then install this, their tokens are stolen again and the worm propagates.

The scope of theft is broad, including local files, process.env, GitHub Actions runner memory, organization secrets, and AWS/Azure/GCP secrets. It also plants hooks in .claude/settings.json and .vscode/tasks.json to re-execute in Claude Code and VS Code, and exfiltrates secrets through an Actions workflow named Formatter as well.

The affected versions are [email protected] and [email protected], and infected environments should be treated as compromised, requiring rotation of tokens and cloud credentials.