Supply chain breach in PyTorch Lightning exposes deep learning projects to Shai-Hulud malware
Security researchers have identified malicious code embedded in the PyPI package `lightning`, which executes upon import to steal tokens and poison development environments.
A sophisticated supply chain attack has compromised versions 2.6.2 and 2.6.3 of the `lightning` package, a widely adopted deep learning framework for PyTorch. The malicious versions, published on 30 April 2026, contain obfuscated JavaScript code that activates automatically when imported by developers. This breach places a significant number of image classifiers, large language model fine-tuning projects, and diffusion model applications at immediate risk.
The threat actor, linked to the Mini Shai-Hulud campaign, has embedded a payload themed after the mythological creature within the package. Upon execution, the malware scans local filesystems, shell environments, and CI/CD pipelines to harvest credentials, authentication tokens, and cloud secrets. It specifically targets major cloud providers including AWS, Azure, and GCP, attempting to exfiltrate sensitive data through multiple parallel channels to ensure success even if individual paths are blocked.
Beyond the initial theft, the attack demonstrates a worm-like propagation mechanism designed to infect other repositories. If the malware discovers valid npm publish credentials, it injects droppers and routers into every package the victim can publish. This creates a chain reaction where downstream developers who install these compromised packages inadvertently run the full malware on their machines, expanding the attack surface beyond the initial entry point.
The sophistication of the operation is further highlighted by its ability to establish persistence within developer tools. The malware injects hooks into configuration files for Claude Code and VS Code, triggering execution whenever a developer opens an infected project folder. Researchers note this may be the first documented instance of malware successfully abusing the hook system within the Claude Code environment, marking a new vector for targeting software development workflows.
Investigations by Semgrep have identified specific indicators of compromise to help organisations detect the intrusion. These include the presence of a hidden `_runtime` directory within the package, commit messages prefixed with `EveryBoiWeBuildIsAWormyBoi`, and the creation of public GitHub repositories with descriptions such as "A Mini Shai-Hulud has Appeared". Teams are advised to audit their repositories for these signs and rotate any compromised tokens immediately.
Developers are urged to verify the integrity of their dependencies and update to versions prior to 2.6.2 or apply patches as soon as they become available. The attack underscores the critical need for rigorous supply chain monitoring, particularly for foundational AI libraries that serve as the backbone for countless applications across the technology sector.
