A malicious supply chain attack targeting the popular PyPI package lightning infected over 1,000 AI developers before its removal from the package repository. Security firm Semgrep reported that compromised versions 2.6.2 and 2.6.3 contained obfuscated payloads designed to steal cloud credentials, SSH keys, and GitHub authentication tokens. The attack compromised machine learning pipelines across AWS, GCP, and Azure while planting persistent hooks inside developer tools.
How the PyPI Malware Functions
The attack targeted the lightning package on PyPI, a widely used deep learning framework employed in fine-tuning large language models and training diffusion models. Published on April 30, 2026, the compromised versions 2.6.2 and 2.6.3 activated automatically upon module import.
Inside the package, a hidden _runtime directory launched a Python loader (start.py) that initialized a 14.8 MB obfuscated JavaScript payload using the Bun runtime. Semgrep identified the operation as a campaign by the threat actor behind "Mini Shai-Hulud," citing consistent Dune-themed naming conventions and commit structures.
Multi-Channel Exfiltration and Cloud Theft
Once executed, the malware targeted environment variables, local files, and system memory. It scanned over 80 file paths for developer tokens and dumped process memory from GitHub Actions runners to extract repository secrets.
The malware extracted sensitive credentials across all major infrastructure providers:
- AWS: Extracted credentials from
~/.aws/credentials, IMDSv2, ECS, Secrets Manager, and SSM parameters. - Azure: Utilized
DefaultAzureCredentialto access Key Vault secrets and active subscriptions. - GCP: Authenticated via
GoogleAuthto dump Secret Manager entries. - GitHub: Exfiltrated tokens (
ghp_,gho_), organization secrets, and repository scopes.
Any machine that imported the malicious package during the affected window should be treated as fully compromised. Exfiltrated data was sent over four parallel channels, including direct HTTPS POSTs, GitHub commit search dead-drops using the prefix EveryBoiWeBuildIsAWormyBoi, and automated public GitHub repository creation.
Persistence via Claude Code and VS Code Hooks
To maintain access across developer environments, the malware planted persistent hooks targeting common developer tooling. This attack represents one of the first documented instances of malware abusing Claude Code's settings configuration in a live environment.