--- title: PyPI package 'lightning' versions 2.6.2 and 2.6.3... description: Two malicious releases of the PyTorch Lightning `lightning` PyPI package (v2.6.2 and v2.6.3) were published on April 30, 2026 using a stolen PyPI API token.... canonical: https://daily.dev/posts/pypi-package-lightning-versions-2-6-2-and-2-6-3-contain-credential-stealing-malware-ihgoeveyv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PyPI package 'lightning' versions 2.6.2 and 2.6.3 contain credential-stealing malware | daily.dev og:description: Two malicious releases of the PyTorch Lightning `lightning` PyPI package (v2.6.2 and v2.6.3) were published on April 30, 2026 using a stolen PyPI API token.... og:url: https://daily.dev/posts/pypi-package-lightning-versions-2-6-2-and-2-6-3-contain-credential-stealing-malware-ihgoeveyv og:image: https://api.daily.dev/og/posts/iHGOevEyV.png og:image:alt: PyPI package 'lightning' versions 2.6.2 and 2.6.3 contain credential-stealing malware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PyPI package 'lightning' versions 2.6.2 and 2.6.3 contain credential-stealing malware **[Collections](https://daily.dev/sources/collections)** · 3 min read · 4 upvotes · 0 comments ## Summary Two malicious releases of the PyTorch Lightning `lightning` PyPI package (v2.6.2 and v2.6.3) were published on April 30, 2026 using a stolen PyPI API token. The malware, dubbed 'ShaiWorm' by Microsoft Threat Intelligence, injects code into `__init__.py` that downloads the Bun JavaScript runtime and executes a heavily obfuscated payload. It steals GitHub/npm tokens, SSH keys, cloud credentials (AWS, Azure, GCP), Kubernetes configs, browser data, and crypto wallets, then exfiltrates everything by committing to GitHub repos using the victim's own credentials. It also has worm behavior, injecting itself into npm packages the victim can publish. Persistence is established via Claude Code session hooks and VS Code tasks. The attack is attributed to the 'Mini Shai-Hulud' campaign, linked to earlier compromises of Bitwarden CLI, Checkmarx KICS, and SAP CAP packages. PyPI has quarantined the project and rolled back to v2.6.1. Affected users should treat their machine as fully compromised and rotate all credentials. ## Content ## What happened On April 30, 2026, two malicious releases of the `lightning` PyPI package (versions 2.6.2 and 2.6.3) were published by an attacker who had obtained a stolen long-lived PyPI API token. This let them push wheels directly, bypassing the legitimate GitHub Actions workflow entirely. Socket's AI scanner flagged both versions 18 minutes after publication. Microsoft Threat Intelligence, which dubbed the payload "ShaiWorm," detected and blocked activity on customer environments. PyPI has since quarantined the project, and the package has been rolled back to the last clean release: v2.6.1 from January 30, 2026. ## How the malware works The malicious versions inject code into `__init__.py` that spawns a background thread on import. That thread silently downloads the Bun JavaScript runtime, then executes a heavily obfuscated ~11 MB payload called `router_runtime.js`, hidden inside a `_runtime` directory bundled with the wheel. What it steals: - GitHub and npm tokens - `.env` files and environment variables - SSH keys and shell histories - Cloud credentials (AWS, Azure, GCP) - Kubernetes configs and Docker credentials - Browser data from Chrome, Firefox, and Brave - Cryptocurrency wallets and VPN credentials - CI/CD pipeline secrets All stolen data is RSA-2048 encrypted and exfiltrated by committing it to GitHub repositories using the victim's own credentials, making the victim appear to be the one pushing the data. ## It spreads This isn't just a stealer — it has worm behavior. The malware scans for npm package tarballs on the developer's machine and injects itself into any npm packages the victim can publish, spreading the attack cross-ecosystem from PyPI into npm. It also establishes persistence through Claude Code session hooks and VS Code folder-open tasks, so it survives beyond the initial infection. ## The Lightning-AI GitHub account looks compromised When a researcher opened an issue warning about the attack, it was closed within one minute with a dismissive meme response. That's a red flag that the project's GitHub account was also under attacker control at the time. ## Attribution This attack is attributed to the same threat actor behind the "Mini Shai-Hulud" campaign — identifiable by Dune-themed commit messages and repository names. The same cipher signature in the payload has appeared in earlier compromises of the Bitwarden CLI, Checkmarx KICS, and SAP CAP packages, suggesting shared tooling across a broader ongoing campaign. ## What to do if you ran the affected versions If you ran `import lightning` with v2.6.2 or v2.6.3, treat the machine as fully compromised. 1. Downgrade to v2.6.1 immediately 2. Rotate every secret, token, and credential that was accessible on the affected machine 3. Audit GitHub for unauthorized commits signed as `claude` 4. Check CI/CD logs for unexpected Bun processes 5. Review any npm packages you maintain for signs of tampering This is part of a broader wave — cPanel and the `intercom-client` npm package were also hit around the same time, alongside a Linux zero-day going public. The supply chain threat is not slowing down. --- Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/pypi-package-lightning-versions-2-6-2-and-2-6-3-contain-credential-stealing-malware-ihgoeveyv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PyPI package 'lightning' versions 2.6.2 and 2.6.3 contain credential-stealing malware","url":"https://daily.dev/posts/pypi-package-lightning-versions-2-6-2-and-2-6-3-contain-credential-stealing-malware-ihgoeveyv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pypi-package-lightning-versions-2-6-2-and-2-6-3-contain-credential-stealing-malware-ihgoeveyv"},"datePublished":"2026-04-30T15:06:26.282Z","dateModified":"2026-05-04T19:00:43.161Z","description":"Two malicious releases of the PyTorch Lightning `lightning` PyPI package (v2.6.2 and v2.6.3) were published on April 30, 2026 using a stolen PyPI API token....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55ef82d2768f660460fae4c4b1578e1a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/55ef82d2768f660460fae4c4b1578e1a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pypi-package-lightning-versions-2-6-2-and-2-6-3-contain-credential-stealing-malware-ihgoeveyv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,python,malware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"PyPI package 'lightning' versions 2.6.2 and 2.6.3 contain credential-stealing malware"}]} ```