PyTorch Lightning: PyPI lightning 2.6.2 and 2.6.3 trojanized to steal credentials (Mini Shai-Hulud)
Severity: high · Patch status: patched · Since 2026-04-30 · CVE-2026-44484
On 30 April 2026 an attacker holding PyPI publishing credentials uploaded two tampered releases of the lightning package, 2.6.2 and 2.6.3, which were installable for about 42 minutes (12:45 to 13:27 UTC) before PyPI quarantined them. The code on GitHub was not touched; the payload lived only in the PyPI artifacts. Importing the library started a hidden thread that fetched the Bun JavaScript runtime and ran a large obfuscated script harvesting cloud (AWS, GCP, Azure) credentials, browser-stored logins, .env files and GitHub tokens and sending them to attacker infrastructure. Wiz assessed the operation as part of the Mini Shai-Hulud campaign (attributed with high confidence to TeamPCP, which also trojanized SAP npm packages the day before). Any environment that imported either version, including CI, should be treated as compromised: roll back to 2.6.1 or move to 2.6.4 or later, and rotate every secret that was reachable. Lightning AI was hit by a separate platform credential breach in October 2026, which Wiz lists in its Black October roundup of at least nine AI developer platforms breached that month.
What to do
- Search all environments, CI runners and lockfiles for lightning 2.6.2 or 2.6.3 (pip freeze, pip cache, container image layers); treat any host that imported either version as compromised
- Upgrade to lightning 2.6.4 or later (2.6.5 and 2.6.6 are current on PyPI) or pin 2.6.1; rebuild images and caches built during 30 April
- Rotate every credential reachable from affected hosts from a clean machine: AWS/GCP/Azure keys, GitHub tokens, .env secrets, browser-saved logins, model-provider keys
- Review CI logs and egress records for unexpected downloads of the Bun runtime and outbound connections to zero.masscan.cloud / 94.154.172.43 from 30 April
- Search GitHub for commit messages containing the keyword beautifulcastle, which the payload uses as a fallback to locate its exfiltration endpoint, in repositories your tokens could reach
- Check your GitHub organisation for new repositories described 'Checkmarx Configuration Storage' and for unexpected commits or workflows
Sources
All live incidents on Threat Watch
