Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

Apr 30, 2026•j12y•View Original

TL;DR Highlight

Lightning 2.6.2 and 2.6.3 on PyPI were compromised with credential-stealing malware that runs on import.

Who Should Read

ML or backend developers who install dependencies with pip and run training or fine-tuning pipelines with PyTorch Lightning.

Core Mechanics

Two lightning versions are compromised
- PyPI package lightning 2.6.2 and 2.6.3 were hit by a supply chain attack on April 30, 2026.
- After pip install, importing the module auto-runs an obfuscated JavaScript payload in a hidden _runtime directory.
It steals credentials broadly
- It targets 80+ credential file paths, environment variables, and GitHub Actions secrets.
- It also reads AWS, Azure, and GCP secret stores (Secrets Manager, Key Vault, Secret Manager).
Exfiltration uses four channels
- HTTPS POST to a C2 server, a GitHub commit-search dead-drop, an attacker's public repo, and pushes to the victim's own repo run in parallel.
- Data still leaves if one path is blocked.
It spreads from PyPI to npm
- If it finds npm publish tokens, it injects a dropper into every package the token can publish and sets a preinstall script.
- It bumps the patch version and republishes, so downstream developers get infected too.
It plants persistence in Claude Code and VS Code
- A SessionStart hook in .claude/settings.json and a folderOpen task in .vscode/tasks.json run setup.mjs whenever the repo is opened.
- The article says this may be among the first documented real-world abuses of Claude Code hooks.
It also drops a malicious GitHub Actions workflow
- With a write-access token, it pushes a workflow named Formatter.
- On every push it dumps all secrets via toJSON(secrets) into an artifact named format-results.

Community Reactions

Commenters feel supply chain attacks are frequent
- One commenter noted several high-profile package attacks appearing recently.
- They argued accessible, easy defensive tooling is lacking for hobby projects that become widely used dependencies.
A comment pointed to pip cooldowns
- A commenter noted pip added cooldowns in 26.1.
- Use pip install --uploaded-prior-to=P1D or the PIP_UPLOADED_PRIOR_TO=P1D env var.
Pinning via lock file worked, per one user
- One user runs a monorepo with a single uv.lock updated only a few times a year, so lightning stayed at 2.6.1.
- The maintainers advised using 2.6.1 until 2.6.4 is published.
Opinion: blindly running AI-suggested pip installs is risky
- One commenter said most of their pip installs come from Claude Code suggestions accepted with enter.
- They noted the model was trained months ago and cannot know what got compromised this week.
Commenters questioned the issue handling
- One pointed out four security issues were auto-commented and closed by a bot called pl-ghost.
- Another cited an April 20 reply saying the 2.6.2 release was blocked for internal reasons and wondered if the problem was known earlier.

How to Apply

Check your lightning version today
- Run pip show lightning and check lock files for 2.6.2 or 2.6.3 in both CI images and local machines.
- If found, pin to 2.6.1 until 2.6.4 is published.
Search for infection artifacts
- Look in your repos for .claude/settings.json, .claude/setup.mjs, .claude/router_runtime.js, .vscode/tasks.json, and .vscode/setup.mjs with unexpected content.
- Also search GitHub for the commit prefix EveryBoiWeBuildIsAWormyBoi and the description "A Mini Shai-Hulud has Appeared".
Rotate all credentials in affected environments
- Treat any machine that imported a bad version as fully compromised and rotate GitHub tokens, cloud credentials, API keys, and npm tokens.
- Also check repos for a Formatter workflow and a format-results artifact.
Enable a pip cooldown
- On pip 26.1 or later, run pip config set global.uploaded-prior-to P1D.
- This delays new releases by a day, giving time for compromises to be found.

Try It

copy & run

# Paste into your shell: check the current environment and repo for lightning infection

pip show lightning | grep -i '^version'
pip list 2>/dev/null | grep -i '^lightning '
grep -rnE 'lightning[=@ ]*2\.6\.(2|3)' requirements*.txt poetry.lock uv.lock Pipfile.lock 2>/dev/null
for f in .claude/settings.json .claude/setup.mjs .claude/router_runtime.js .vscode/tasks.json .vscode/setup.mjs; do [ -e "$f" ] && echo "Needs review: $f"; done
git log --all --oneline | grep -i 'EveryBoiWeBuildIsAWormyBoi'
python -c "import importlib.util,os;s=importlib.util.find_spec('lightning');print('_runtime exists' if s and os.path.isdir(os.path.join(os.path.dirname(s.origin),'_runtime')) else 'no _runtime')"
pip config set global.uploaded-prior-to P1D

Terminology

Supply chain attackAn attack that poisons a library's distribution so everyone who installs it gets infected. Like tampering with ingredients delivered to a restaurant.

Dead-dropA way to pass messages through a public place instead of connecting directly. Here, GitHub commit messages act as the mailbox.

C2The attacker's server where malware sends stolen data and receives commands.

IOCAn indicator of compromise: a trace such as a file name, commit message, or repo description that signals infection.

PersistencePlanting malware in auto-run spots so it survives restarts and keeps executing.

CooldownA setting that only installs versions after they've been published for some time, buying time for compromises to be discovered.

Related Resources

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

Apr 30, 2026•j12y•View Original

TL;DR Highlight

Lightning 2.6.2 and 2.6.3 on PyPI were compromised with credential-stealing malware that runs on import.

Who Should Read

ML or backend developers who install dependencies with pip and run training or fine-tuning pipelines with PyTorch Lightning.

Core Mechanics

Two lightning versions are compromised
- PyPI package lightning 2.6.2 and 2.6.3 were hit by a supply chain attack on April 30, 2026.
- After pip install, importing the module auto-runs an obfuscated JavaScript payload in a hidden _runtime directory.
It steals credentials broadly
- It targets 80+ credential file paths, environment variables, and GitHub Actions secrets.
- It also reads AWS, Azure, and GCP secret stores (Secrets Manager, Key Vault, Secret Manager).
Exfiltration uses four channels
- HTTPS POST to a C2 server, a GitHub commit-search dead-drop, an attacker's public repo, and pushes to the victim's own repo run in parallel.
- Data still leaves if one path is blocked.
It spreads from PyPI to npm
- If it finds npm publish tokens, it injects a dropper into every package the token can publish and sets a preinstall script.
- It bumps the patch version and republishes, so downstream developers get infected too.
It plants persistence in Claude Code and VS Code
- A SessionStart hook in .claude/settings.json and a folderOpen task in .vscode/tasks.json run setup.mjs whenever the repo is opened.
- The article says this may be among the first documented real-world abuses of Claude Code hooks.
It also drops a malicious GitHub Actions workflow
- With a write-access token, it pushes a workflow named Formatter.
- On every push it dumps all secrets via toJSON(secrets) into an artifact named format-results.

Community Reactions

Commenters feel supply chain attacks are frequent
- One commenter noted several high-profile package attacks appearing recently.
- They argued accessible, easy defensive tooling is lacking for hobby projects that become widely used dependencies.
A comment pointed to pip cooldowns
- A commenter noted pip added cooldowns in 26.1.
- Use pip install --uploaded-prior-to=P1D or the PIP_UPLOADED_PRIOR_TO=P1D env var.
Pinning via lock file worked, per one user
- One user runs a monorepo with a single uv.lock updated only a few times a year, so lightning stayed at 2.6.1.
- The maintainers advised using 2.6.1 until 2.6.4 is published.
Opinion: blindly running AI-suggested pip installs is risky
- One commenter said most of their pip installs come from Claude Code suggestions accepted with enter.
- They noted the model was trained months ago and cannot know what got compromised this week.
Commenters questioned the issue handling
- One pointed out four security issues were auto-commented and closed by a bot called pl-ghost.
- Another cited an April 20 reply saying the 2.6.2 release was blocked for internal reasons and wondered if the problem was known earlier.

How to Apply

Check your lightning version today
- Run pip show lightning and check lock files for 2.6.2 or 2.6.3 in both CI images and local machines.
- If found, pin to 2.6.1 until 2.6.4 is published.
Search for infection artifacts
- Look in your repos for .claude/settings.json, .claude/setup.mjs, .claude/router_runtime.js, .vscode/tasks.json, and .vscode/setup.mjs with unexpected content.
- Also search GitHub for the commit prefix EveryBoiWeBuildIsAWormyBoi and the description "A Mini Shai-Hulud has Appeared".
Rotate all credentials in affected environments
- Treat any machine that imported a bad version as fully compromised and rotate GitHub tokens, cloud credentials, API keys, and npm tokens.
- Also check repos for a Formatter workflow and a format-results artifact.
Enable a pip cooldown
- On pip 26.1 or later, run pip config set global.uploaded-prior-to P1D.
- This delays new releases by a day, giving time for compromises to be found.

Try It

copy & run

# Paste into your shell: check the current environment and repo for lightning infection

pip show lightning | grep -i '^version'
pip list 2>/dev/null | grep -i '^lightning '
grep -rnE 'lightning[=@ ]*2\.6\.(2|3)' requirements*.txt poetry.lock uv.lock Pipfile.lock 2>/dev/null
for f in .claude/settings.json .claude/setup.mjs .claude/router_runtime.js .vscode/tasks.json .vscode/setup.mjs; do [ -e "$f" ] && echo "Needs review: $f"; done
git log --all --oneline | grep -i 'EveryBoiWeBuildIsAWormyBoi'
python -c "import importlib.util,os;s=importlib.util.find_spec('lightning');print('_runtime exists' if s and os.path.isdir(os.path.join(os.path.dirname(s.origin),'_runtime')) else 'no _runtime')"
pip config set global.uploaded-prior-to P1D

Terminology

Supply chain attackAn attack that poisons a library's distribution so everyone who installs it gets infected. Like tampering with ingredients delivered to a restaurant.

Dead-dropA way to pass messages through a public place instead of connecting directly. Here, GitHub commit messages act as the mailbox.

C2The attacker's server where malware sends stolen data and receives commands.

IOCAn indicator of compromise: a trace such as a file name, commit message, or repo description that signals infection.

PersistencePlanting malware in auto-run spots so it survives restarts and keeps executing.

CooldownA setting that only installs versions after they've been published for some time, buying time for compromises to be discovered.

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library

TL;DR Highlight

Who Should Read

Core Mechanics

Community Reactions

How to Apply

Try It

Terminology

Related Papers

Related Resources