2026-04-30 · 2026-Q2
PyTorch Lightning PyPI Compromise (Mini Shai-Hulud)
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
`lightning` on PyPI, versions 2.6.2 and 2.6.3 (~311,000 daily downloads)
Impact
A hidden `_runtime` directory executes at import time, fetching the Bun runtime and running an ~11 MB obfuscated JavaScript credential stealer that targets GitHub, npm, and cloud tokens; it poisons local repositories with commits forged as `claude` and self-propagates by mutating npm tarballs and publishing directly to the registry
Root cause
Maintainer or publish-credential compromise carrying a Mini Shai-Hulud payload, linked by shared obfuscation signatures to the broader npm and PyPI worm campaign
Sources
Catalog
Cite this: AgentProv incident record: PyTorch Lightning PyPI Compromise (Mini Shai-Hulud) (2026-04-30). https://agentprov.com/incidents/2026-04-30-pytorch-lightning-pypi-compromise-mini-shai-hulud