Notifications
Clear all
Topic starter
02/08/2026 11:41 am
TL;DR: A compromised PyPI package, lightning 2.6.2 and 2.6.3, silently exfiltrates developer credentials, cloud secrets, wallet data, and session tokens via a background payload that uploads encrypted data to public GitHub repositories, according to Aikido. The incident shows how package trust, install-time execution, and secret sprawl combine into a single compromise path that IAM and NHI teams cannot treat as separate problems.
NHIMG editorial — based on content published by Aikido: Popular PyTorch Lightning package compromised by Mini Shai-Hulud
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when a compromised package can run code during install or import?
A: The trust boundary around software installation breaks first.
Q: Why do supply chain attacks on developer tools create such large identity risk?
A: Developer tools often run with trusted access to cloud, source control, and orchestration systems, so compromise turns one execution context into a multi-system identity event.
Q: How can security teams tell whether secret management is actually working?
A: Look for fewer plaintext secrets, narrower reuse, faster rotation, and a shrinking set of credentials that remain valid across multiple systems.
Practitioner guidance
- Harden package execution boundaries Block or sandbox dependency install and import paths so unreviewed packages cannot execute arbitrary code during developer or CI workflows.
- Shorten the lifetime of exposed secrets Replace long-lived API keys, cloud tokens, and service credentials with short-lived, scoped alternatives wherever possible.
- Triage developer endpoints as identity assets Monitor shell histories, local config stores, and developer tooling directories as part of identity incident response, not just endpoint malware response.
What's in the full analysis
Aikido's full post covers the operational detail this post intentionally leaves for the source:
- IOC-level detail for lightning==2.6.2 and lightning==2.6.3, including the malicious file names and hashes.
- The exact package behaviour inside __init__.py, start.py, and router_runtime.js, including the bootstrap sequence.
- The complete list of stolen artefact types, from cloud credentials to VPN data and cryptocurrency wallets.
- Aikido-specific detection and rescan guidance for users already monitoring malware issues.
👉 Read Aikido's analysis of the Mini Shai-Hulud PyPI compromise →
PyPI supply chain malware in lightning: what should teams do now?
Explore further
02/08/2026 12:53 pm
Package trust is now identity trust. When a dependency can execute before the application starts, the package manager becomes a credential distribution layer whether teams intended it or not. That collapses the old separation between software supply chain risk and identity governance. Practitioners should treat dependency execution as an access event and not as a purely application security problem.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
A question worth separating out:
Q: What should teams do immediately when credentials are found in public exfiltration paths?
A: Revoke the exposed credential, terminate related sessions, and search for lateral reuse across cloud, CI/CD, and developer tooling before deeper cleanup begins. Public exfiltration means the attacker may already have copied the secret, so containment must focus on eliminating reuse windows and checking for secondary access using the same identity material.
👉 Read our full editorial: Mini Shai-Hulud in PyPI exposes the limits of package trust
