Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

PyTorch Lightning hit by network compromise

Incident
First reported
Last updated
Happening score
H score 36
1 unique sources, 1 articles

Summary

Hide ▲

A malicious PyTorch Lightning release on PyPI created a supply-chain compromise that can steal credentials as soon as the package is imported. The backdoored version 2.6.3 uses a hidden execution chain to download Bun v1.3.13 and run an obfuscated payload. That payload targets .env files, browser-stored secrets, and AWS, Azure, and GCP credentials, putting developer and cloud accounts at risk. Microsoft Threat Intelligence says Defender detected and blocked the activity on a small number of devices, and the package was reverted to 2.6.1.

Related Happenings

BoryptGrab infostealer variant delivered via fake GitHub repositories

Malware Activity
H score30 First: 14.07.2026 22:15 Last: 14.07.2026 22:15 Sources 1

About this happening: A BoryptGrab infostealer variant is being delivered through fake GitHub repositories, expanding a credential-theft operation that can drain browser, wallet, and messaging...

Open Happening

Jscrambler 8.14.0 malicious preinstall infostealer release

Malware Activity
H score9 First: 11.07.2026 20:59 Last: 11.07.2026 20:59 Sources 1

About this happening: The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...

Open Happening

Atomic-lockfile rootkit-infostealer distribution through AUR packages

Malware Activity
H score3 First: 12.06.2026 20:03 Last: 12.06.2026 20:03 Sources 1

About this happening: AUR packages are distributing the atomic-lockfile Linux rootkit and infostealer through compromised build scripts, with more than 400 packages reported and the o...

Open Happening

Shai-Hulud worm clone activity on NPM

Malware Activity
H score69 First: 18.05.2026 12:45 Last: 18.05.2026 12:45 Sources 1

About this happening: The Shai-Hulud malware activity has continued to evolve across the npm supply chain and related developer ecosystems. It first infected npm packages in September 202...

Open Happening

Node-ipc malicious versions with stealer/backdoor payload

Malware Activity
H score34 First: 14.05.2026 20:22 Last: 14.05.2026 20:22 Sources 1

About this happening: Three node-ipc releases now carry an obfuscated stealer/backdoor that can harvest developer and cloud secrets from any system that loads the package. The malicious cod...

Open Happening

Timeline

  1. 04.05.2026 20:15 2 articles · 2mo ago

    Lightning AI discloses malicious PyTorch Lightning 2.6.3

    Initial Disclosure

    Lightning AI discloses that PyTorch Lightning 2.6.3 on PyPI contains a hidden execution chain that triggers on import, downloads a JavaScript runtime, and runs an obfuscated payload tied to credential theft from browsers, .env files, and cloud services.

    Show sources
    Open in new tab
  2. 04.05.2026 20:15 1 articles · 2mo ago

    Microsoft Defender detects and blocks ShaiWorm on customer devices

    Detection Ioc Update

    Microsoft Threat Intelligence reports that Defender detected and prevented the malicious PyTorch Lightning routine in customer environments, notified the maintainer, and observed activity affecting a small number of devices in a narrow set of environments.

    Show sources
    Open in new tab
  3. 04.05.2026 20:15 1 articles · 2mo ago

    PyTorch Lightning reverts package to 2.6.1 on PyPI

    Mitigation Patch Update

    PyTorch Lightning has been reverted to 2.6.1 on PyPI, which is described as safe to use, while users who imported 2.6.3 are advised to rotate all secrets, keys, and tokens that may have been exposed.

    Show sources
    Open in new tab