PyTorch Lightning 2.6.3 Supply‑Chain Attack Steals Credentials

A malicious version of the PyTorch Lightning package, released as 2.6.3 on the Python Package Index (PyPI), was discovered to contain a hidden execution chain that automatically downloaded the JavaScript runtime Bun v1.3.13 and executed an 11.4 MB obfuscated payload named router_runtime.js. The script was designed to harvest a wide range of secrets, including .env files, API keys, GitHub tokens, browser credentials, and cloud‑provider API credentials, while also providing the attacker with the ability to run arbitrary system commands. Microsoft Defender identified the routine as “ShaiWorm” and blocked its execution in affected environments, but the initial compromise had already exposed sensitive data in many installations.

The attack was uncovered when security researchers noticed unusual network activity originating from the PyTorch Lightning package. The malicious chain was engineered to run silently after the package was imported, making it difficult to detect without active monitoring. Once the payload was executed, it could exfiltrate credentials over the internet and potentially compromise the entire host system. The discovery prompted an immediate rollback of the PyTorch Lightning package to the previous safe release, version 2.6.1, and the maintainers issued a public advisory urging all users who had installed 2.6.3 to rotate every secret and audit their environments for any signs of the payload or related malicious code.

PyTorch Lightning’s response included a full audit of all recent releases and a commitment to strengthen its supply‑chain security practices. The incident highlights the growing threat of supply‑chain attacks in the open‑source ecosystem, where a single compromised package can expose thousands of developers and organizations worldwide. The broader community has called for more rigorous verification of third‑party dependencies and better tooling to detect malicious code before it reaches end users.

The incident also underscores the importance of proactive security measures such as multi‑factor authentication, secret rotation, and continuous monitoring of package integrity. While Microsoft Defender successfully blocked the payload in many cases, the attack demonstrates that even well‑protected environments can be vulnerable if a trusted dependency is compromised. The investigation into the origin of the malicious package is ongoing, and all PyTorch Lightning releases will undergo enhanced scrutiny to prevent a recurrence.