Compromised Lightning PyPI Releases Steal Credentials and Spread Through GitHub and npm
Summary
Socket reports that malicious lightning versions 2.6.2 and 2.6.3 run an obfuscated payload on import, stealing credentials and attempting to poison GitHub repositories and infect npm packages.
Key points
- Socket identifies lightning versions 2.6.2 and 2.6.3 as malicious; version 2.6.1 is reported as clean.
- Importing the package triggers a downloader that installs Bun and runs an obfuscated JavaScript payload.
- The payload searches for GitHub, npm, cloud, and CI credentials, and validates some discovered tokens.
- With stolen GitHub tokens, it can inject files into repository branches, including a self-copy and workflow-related files.
- The malware can modify local npm package tarballs to add a postinstall hook and bump package versions.
- Suspicious GitHub account activity and suppression of disclosure issues suggest possible maintainer-account compromise, but the scope is unconfirmed.
- Socket recommends removing affected versions, treating systems that installed and imported them as compromised, rotating exposed credentials, and auditing repositories, CI systems, and npm artifacts.
Article Details
- Attack Vectors
- Compromised PyPI releases lightning 2.6.2 and 2.6.3 execute a hidden downloader and obfuscated JavaScript payload automatically when the package is imported.
- The payload harvests developer and cloud credentials, then uses stolen GitHub tokens to add or overwrite files across writable repository branches.
- The payload infects local npm package tarballs by injecting a setup script, adding a postinstall hook, and incrementing the package version.
- An apparently compromised pl-ghost GitHub account was used to suppress disclosure issues and probe other Lightning-AI repositories with short-lived branches. The article says these attempts did not reach default branches or trigger workflows.
- The article reports that an onion link posted in the GitHub issue thread pointed to a Team PCP-branded site, but Socket had not verified the site's authenticity or the claimed attribution.
- Defensive Notes
- Remove lightning versions 2.6.2 and 2.6.3 from affected systems; downgrade to 2.6.1 or wait for maintainer confirmation before upgrading.
- Treat environments that installed and imported either compromised version as compromised.
- Rotate credentials accessible in affected environments, including GitHub and npm tokens, cloud credentials, and secrets stored in environment variables.
- Review repositories for unauthorized commits or encoded data, and audit CI/CD logs, developer machines, build systems, and CI artifact caches.
- Check local npm tarballs for unexpected postinstall hooks and version bumps; review repositories containing .claude/router_runtime.js and audit for unauthorized commits attributed to claude@users.noreply.github.com.
- Review GitHub Actions logs for unexpected workflow runs associated with .github/workflows/format-check.yml.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 40d0f21b64ec8fb3a7a1959897252e09 | MD5 hash listed for the malicious router_runtime.js file. |
| SHA1 | f1b3e7b3eec3294c4d6b5f87854a52471f03997f | SHA-1 hash listed for the malicious router_runtime.js file. |
| SHA256 | 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1 | SHA-256 hash listed for the malicious router_runtime.js file. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript payload uses string-array rotation, encoded strings, and an additional AES-based decryption layer.T1059.007 · JavaScriptThe package runs an obfuscated JavaScript payload using the Bun runtime.T1195.002 · Compromise Software Supply ChainThe attacker published malicious lightning versions through the PyPI package supply chain.T1528 · Steal Application Access TokenThe payload scans for GitHub and npm tokens and validates discovered credentials before using them.T1552.005 · Cloud Instance Metadata APIThe payload queries AWS instance metadata and ECS credential endpoints to obtain instance-role credentials.T1567.001 · Exfiltration to Code RepositoryThe payload uses stolen GitHub credentials to commit encoded data to repositories.
Threat Actors
LAPSUS$The quoted Team PCP message claims LAPSUS$ was a partner involved in the operation; Socket had not independently confirmed that claimed relationship.Team PCPThe article says an attacker posted a link to a Team PCP-branded site and quotes a message identifying the group as TEAM PCP; Socket had not verified the site's authenticity or the claimed connection to the compromise.
Malware
Products
Claude Code'.claude/settings.json': x4f, // tampered Claude Code settingsGitHubstart.py, which downloads and executes Bun, a JavaScript runtime, from GitHublightningThe popular PyPI package lightning has been compromised in a supply chain attack affecting newly published versions of the package.npmCapability to infect developer NPM package tarballsPyPIThe popular PyPI package lightning has been compromised in a supply chain attack affecting newly published versions of the package.