Case pytorch-lightning-2-6-3-backdoorAI supply chainUnited States
Backdoored PyTorch Lightning 2.6.3 on PyPI runs Bun-based credential stealer on import
Lightning AI disclosed that version 2.6.3 of the lightning package was published with a payload that downloads the Bun runtime and an 11.4 MB obfuscated JavaScript stealer targeting browser data, .env files, GitHub tokens and cloud credentials.
HighAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 30, 2026
- Location
- United States
- Target
- PyTorch Lightning users
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Lightning AI disclosed that version 2.6.3 of the lightning package was published with a payload that downloads the Bun runtime and an 11.4 MB obfuscated JavaScript stealer targeting browser data, .env files, GitHub tokens and cloud credentials.
Impact: Microsoft reported a small number of affected devices; anyone who imported lightning 2.6.3 was told to rotate all secrets
Who triggered it
Actor: Unknown
Attribution: Microsoft Threat Intelligence tracks the routine as ShaiWorm; the maintainers were still investigating how the release pipeline was breached
Motive: Theft of developer, cloud and source control credentials
How it happened
Attack vector: Malicious py3-none-any wheel on PyPI that starts a background process on import, fetches Bun v1.3.13 from GitHub and executes router_runtime.js
Root cause: Compromised build or release pipeline of a widely used ML framework; cause under investigation
Timeline
- Lightning AI discloses malicious 2.6.3 and reverts PyPI to 2.6.1
- Microsoft says Defender blocked the routine on a small number of devices
Response
Package reverted to 2.6.1, users notified, audit of other recent releases promised
Current status: Contained
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- BleepingComputer PyPI tag bleepingcomputer.com
Cite this case
Backdoored PyTorch Lightning 2.6.3 on PyPI runs Bun-based credential stealer on import. AI Threat Watch, case pytorch-lightning-2-6-3-backdoor, Apr 30, 2026. https://aithreat.io/cases/pytorch-lightning-2-6-3-backdoor/
Permanent link: https://aithreat.io/cases/pytorch-lightning-2-6-3-backdoor/