lightning: Obfuscated JavaScript Credential Stealer Bundled in PyPI Wheel
The lightning PyPI package versions 2.6.2 and 2.6.3 were compromised on April 30, 2026, containing obfuscated JavaScript code designed to steal credentials. The project's GitHub account showed signs of compromise, with suspicious responses closing vulnerability reports.
- Disclosed
- Last updated
- Blast radius
- PyPI package users; direct dependents of lightning 2.6.2 and 2.6.3
- Ecosystems
- Attack vectors
- Threat actor
- Affected entities
- lightning · 2.6.2, 2.6.3
On April 30, 2026, a supply chain compromise was identified affecting the lightning package on PyPI. Versions 2.6.2 and 2.6.3 contained obfuscated JavaScript credential stealer code bundled within the wheel distribution.\n\nInvestigation revealed that the project's GitHub account exhibited signs of compromise. Issues reporting the attack were rapidly closed by suspicious accounts responding to the reports, suggesting active control by threat actors during the incident window.\n\nThe use of obfuscated JavaScript in a Python wheel indicates a sophisticated attack designed to evade automated detection and make reverse engineering more difficult for security researchers and package maintainers.
Remediation
- Immediately uninstall or upgrade lightning to a patched version beyond 2.6.3
- Audit any systems that installed lightning 2.6.2 or 2.6.3 for credential compromise or unauthorized access
- Review git history and access logs for the lightning GitHub repository to identify the exact point of compromise
- Implement code signing and verification for all PyPI packages in your dependency chain
- Use dependency scanning tools to detect vulnerable or compromised packages in real-time
Sources
- lightning: Obfuscated JavaScript Credential Stealer Bundled in PyPI Wheel · StepSecurity
- shai-hulud-detect compromised-packages.txt (Lightning AI section) · Cobenian (community; vendor write-ups: Socket, Aikido, StepSecurity, Lightning AI)
Cite this entry
"lightning: Obfuscated JavaScript Credential Stealer Bundled in PyPI Wheel." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed April 30, 2026; last updated June 7, 2026. https://supplychainattack.org/incident/lightning-obfuscated-javascript-credential-stealer-bundled-in-pypi-wheel-1h10or
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
TeamPCP Injects Two-Stage Credential Stealer into xinference PyPI Package
The xinference package on PyPI was compromised with a two-stage credential stealer attributed to the TeamPCP threat actor. The malicious code was injected into the package, potentially affecting users who installed compromised versions.
TeamPCPPyPICompromised packageMalicious maintainer - containedcritical
Malicious code in intercom-php (Packagist)
The intercom-php package on Packagist was compromised with malicious code as part of the Mini Shai-Hulud campaign by the TeamPCP threat actor. The malicious payload steals credentials and can propagate to NPM packages using discovered credentials.
Mini Shai HuludTeamPCPNuGetCompromised packageMalicious maintainer - containedcritical
SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
Three RubyGems (git_credential_manager, Dendreo, and fastlane) were compromised to deliver a persistent backdoor named SleeperGem. The malicious packages fetch a second stage payload from a Forgejo C2 server, bypass CI checks, and install a persistent daemon on developer machines.
RubyGemsCompromised packageMalicious maintainer - activecritical
Malicious code in github.com/BufferZoneCorp/go-stdlog (Go)
The Go package github.com/BufferZoneCorp/go-stdlog contains malicious code that steals credentials, establishes SSH access, and tampers with build and workflow environment variables. It is part of a broader cluster of malicious packages affecting both Go and RubyGems ecosystems.
GoCompromised packageMalicious maintainer