cyber.hendryadrian.com
Threat Research · stepsecurity.io

Obfuscated Credential Stealer Found in Compromised PyPI lightning Releases

· Original article ↗

Summary

StepSecurity reports that lightning 2.6.2 and 2.6.3 contain an import-triggered, obfuscated JavaScript payload that steals credentials, abuses GitHub to exfiltrate data, and infects npm tarballs. Full payload analysis is ongoing.

Key points

  • StepSecurity identified malicious code in lightning PyPI versions 2.6.2 and 2.6.3; it identifies 2.6.1, published January 30, 2026, as the last clean release.
  • On import, a daemon thread silently downloads the Bun JavaScript runtime and runs an 11 MB obfuscated payload from a hidden _runtime directory.
  • Static analysis indicates the payload targets tokens, API keys, environment variables, authentication material, and cloud secrets.
  • The payload uses victims’ GitHub credentials to commit encoded stolen data to repositories.
  • The malware also injects code into npm package tarballs on the developer’s machine, potentially spreading to downstream consumers.
  • The article reports signs of compromise in the project’s GitHub account; a token-based takeover is presented as a likely explanation, not a confirmed finding.
  • StepSecurity says Harden-Runner can flag suspicious process access to GitHub Actions runner memory; full payload analysis remains ongoing.

Article Details

Attack Vectors
  • Compromised PyPI releases lightning 2.6.2 and 2.6.3 bundle a hidden _runtime directory; importing the package starts a silent daemon thread.
  • The package downloads the Bun JavaScript runtime from GitHub and uses it to execute the heavily obfuscated router_runtime.js payload.
  • The payload steals credentials, tokens, environment variables, and cloud secrets, then commits encoded stolen data to repositories through the GitHub API using the victim’s credentials.
  • The payload injects malicious code into npm package tarballs on the developer’s machine, potentially spreading to downstream consumers.
  • The article describes attacks in this family using a Python child process to scan /proc and read /proc/{pid}/mem from a GitHub Actions Runner.Worker process to extract secrets.
Defensive Notes
  • The article identifies lightning 2.6.1 as the last clean release; versions 2.6.2 and 2.6.3 are compromised.
  • StepSecurity says Harden-Runner’s process monitor can flag unauthorized process-memory access as a suspicious process event.
  • The article notes that static analysis of the Python wheel alone cannot reveal the full capabilities of the obfuscated JavaScript payload fetched at runtime.

MITRE ATT&CK

T1003.007 · Proc FilesystemThe article describes attacks in this family reading /proc/{pid}/mem from the GitHub Actions Runner.Worker process to extract secrets.T1027 · Obfuscated Files or InformationThe router_runtime.js payload is described as heavily obfuscated.T1059.006 · PythonThe article describes attacks in this family using a Python child process to scan /proc and access process memory.T1059.007 · JavaScriptThe package executes the obfuscated router_runtime.js payload using the downloaded Bun runtime.T1105 · Ingress Tool TransferThe compromised package downloads the Bun JavaScript runtime from GitHub at execution time.T1195.002 · Compromise Software Supply ChainMalicious code was bundled in compromised lightning PyPI releases and injected into npm package tarballs on developer machines.T1567.001 · Exfiltration to Code RepositoryThe payload commits encoded stolen data to repositories through the GitHub API using the victim’s credentials.

Vendors

Lightning AIThe lightning package (Lightning AI, formerly PyTorch Lightning) is one of the most widely used deep learning frameworks in the Python ecosystem. It provides a high-level interface for training PyTorch models and is aStepSecurityHow StepSecurity Helps

Products

BunOn import, a daemon thread silently downloads the Bun JavaScript runtime from GitHub and executes router_runtime.js — an 11 MB heavily obfuscated payload. The malware steals tokens, credentials, environment variables,GitHubchain compromise was identified in the lightning PyPI package — versions 2.6.2 and 2.6.3. The project’s GitHub account shows signs of compromise, with issues reporting the attack closed rapidly by suspiciousHarden-RunnerHarden-Runner detects this attack at the process layer. Attacks in this family use a Python child process to scan /proc for the GitHub Actions Runner.Worker process and dump its readable memory via /proc/{pid}/mem,lightningOn April 30, 2026, a supply chain compromise was identified in the lightning PyPI package — versions 2.6.2 and 2.6.3. The project’s GitHub account shows signs of compromise, with issues reporting the attack closednpmthe GitHub API to commit exfiltrated data to repositories using the victim’s own credentials; and infects npm package tarballs on the developer’s machine. The project’s GitHub account shows signs of compromise, withPyPIOn April 30, 2026, a supply chain compromise was identified in the lightning PyPI package — versions 2.6.2 and 2.6.3. The project’s GitHub account shows signs of compromise, with issues reporting the attack closed

Tools

harden-runnerHarden-Runner detects this attack at the process layer. Attacks in this family use a Python child process to scan /proc for the GitHub Actions Runner.Worker process and dump its readable memory via /proc/{pid}/mem,

Related Articles