Shai-Hulud-themed Malware Found in PyTorch Lightning AI Training Library | Semgrep

lightning 2.6.2 and 2.6.3 on PyPI were exploited in a supply chain attack. Simply running pip install lightning can trigger a hidden _runtime directory and an obfuscated JavaScript payload.

The malware auto-executes on module import, stealing credentials, authentication tokens, environment variables, and cloud secrets. It also attempts GitHub repository poisoning, and any machine that imported the malicious package during the affected period should be considered fully compromised.

The attack starts at PyPI, but worm propagation happens through npm. When it finds npm publishing credentials, it injects a setup.mjs dropper and router_runtime.js into packages, sets up an execution path via scripts.preinstall, and republishes a patched version.

Exfiltration uses multiple parallel channels.

• HTTPS POST to C2
• GitHub commit search dead drops
• Attacker-controlled public GitHub repositories
• Direct pushes to victim repositories

Indicators include commits prefixed with EveryBoiWeBuildIsAWormyBoi and repositories described as "A Mini Shai-Hulud has Appeared". Signs of compromise include .claude/settings.json, .claude/setup.mjs, .claude/router_runtime.js, .vscode/tasks.json, and .vscode/setup.mjs.

Theft targets are broad, spanning local files, environment variables, GitHub Actions, AWS, Azure, and GCP. In particular, it plants Claude Code's SessionStart hook and VS Code's runOn: folderOpen task so the dropper runs every time the repository is opened.