Supply Chain Attack on PyTorch Lightning: Malicious Versions 2.6.2 and 2.6.3 Steal Credentials via PyPI

Overview

In a recent incident highlighting ongoing risks in open-source ecosystems, threat actors successfully infiltrated the popular Python package Lightning, a widely used library for PyTorch. The attack resulted in the release of two malicious versions—2.6.2 and 2.6.3—on April 30, 2026, designed to harvest user credentials. This supply chain compromise was identified and reported by cybersecurity firms Aikido Security, Socket, and StepSecurity, who warn that the campaign is part of a broader pattern of attacks targeting PyPI packages.

Attack Details

How the Compromise Occurred

The attackers gained unauthorized access to the Lightning project's PyPI publishing credentials, likely through phishing or exploiting weak security measures. Once inside, they uploaded the tainted versions, which contained code that exfiltrated sensitive data from users who installed or updated the package. The malicious payload specifically targeted environment variables, API tokens, and other credentials stored on infected systems.

Timeline and Scope

Versions 2.6.2 and 2.6.3 were released on the same day, suggesting a coordinated and rapid deployment of the attack. The malicious packages were available for download for a limited period before being taken down by PyPI maintainers following alerts from security teams. Given Lightning's popularity among machine learning practitioners, the potential impact is significant, with thousands of projects potentially exposed.

Technical Analysis

Security researchers uncovered that the malicious code added a dependency to a remote server via a dynamic import, allowing the attackers to collect credential data stealthily. The code was obfuscated to evade detection by basic security scans. Notably, the attack mirrors previous supply chain incidents where popular Python libraries were weaponized to steal tokens and passwords.

Impact and Mitigation

Affected Users and Systems

Any developer or organization that installed PyTorch Lightning version 2.6.2 or 2.6.3 between April 30 and the removal date is at risk. Credentials stored in environment variables, cloud provider keys, and CI/CD pipeline secrets may have been compromised. Immediate rotation of all credentials is strongly advised.

Response from the Community

The PyPI team swiftly removed the malicious versions and flagged them in security advisories. The Lightning project maintainers have released a clean version 2.6.4, urging all users to update. Additionally, security firms like Aikido and Socket have published IoCs (Indicators of Compromise) to help organizations detect potential breaches.

Recommendations

• Update Immediately: Upgrade to PyTorch Lightning version 2.6.4 or later. Verify the package hash against the official checksum.
• Rotate Credentials: Change all API keys, tokens, and passwords that may have been exposed during the window of compromise.
• Monitor Logs: Review system and network logs for unusual outbound connections to unknown IPs.
• Enable Two-Factor Authentication: Secure PyPI accounts with 2FA to prevent unauthorized package publication.
• Use Package Integrity Tools: Employ tools like pip's hash checking or SLSB (Software Bill of Materials) to verify package authenticity.

This incident underscores the critical need for enhanced security practices in the open-source supply chain. Developers must remain vigilant and adopt proactive measures to protect against similar attacks.