The Shai-Hulud Worm Crossed From npm Into PyPI on April 30. PyTorch Lightning, the AI Training Framework With Hundreds of Thousands of Daily Downloads, Was Compromised in Versions 2.6.2 and 2.6.3. The Same Payload That Hit SAP npm Packages Twenty-Four Hours Earlier. Socket Detected It Eighteen Minutes After Publication. Every ML Pipeline That Pip-Installed Lightning Yesterday Should Treat That Machine as Compromised.

WHAT HAPPENED

PyTorch Lightning is one of the most widely deployed Python packages in the AI training ecosystem. The framework provides a high-level interface for PyTorch that abstracts away boilerplate code in distributed training, mixed precision, gradient accumulation, and checkpointing. ML practitioners building image classifiers, fine-tuning large language models, running diffusion models, and developing time-series forecasters routinely have Lightning somewhere in their dependency tree. The package has more than 31,100 stars on GitHub and hundreds of thousands of daily downloads on PyPI.

On April 30, 2026, two new versions of Lightning appeared on PyPI: 2.6.2 and 2.6.3. Both versions contained a hidden _runtime directory and a modified lightning/__init__.py that imported and executed a malicious payload during normal package import. Socket flagged both versions as malicious eighteen minutes after publication. PyPI administrators quarantined the project. The Lightning maintainers acknowledged the compromise and began investigating. The last known clean baseline is version 2.6.1.

The malware payload is the part that matters architecturally. The Python dropper in __init__.py spawned a background thread that downloaded version 1.3.13 of the Bun JavaScript runtime and used it to execute an eleven-megabyte obfuscated JavaScript file called router_runtime.js. The JavaScript payload is byte-for-byte identical to the execution.js payload that was discovered in the SAP CAP npm package compromises published twenty-four hours earlier on April 29. Same credential collectors. Same GitHub worm. Same npm republisher. Same command-and-control encryption scheme. Different ecosystem. Same campaign.

THE CROSS-ECOSYSTEM SHIFT

The Shai-Hulud campaign first appeared in npm. The Mini Shai-Hulud variant has been running against the npm ecosystem for several weeks, hitting the @bitwarden/cli compromise, the SAP CAP packages, the Cloud MTA tooling, lightning@2.6.2 in npm, and intercom-client@7.0.4. The PyTorch Lightning compromise on PyPI is the first confirmed deployment of the same payload outside npm. The campaign has now demonstrated cross-ecosystem operational capability.

The technical architecture of that crossing is worth attention. The attackers did not rewrite their payload for Python. They wrote a thin Python dropper, used it to bootstrap Bun, and ran the existing JavaScript payload unchanged. This means the payload code, the persistence techniques, the propagation mechanisms, and the exfiltration channels are all reusable across any ecosystem that can spawn a JavaScript runtime. PyPI today. PyPI is not the last. The same approach works against any package ecosystem where install-time or import-time code execution is possible. RubyGems, Cargo, Maven, NuGet, Composer, and Go modules all support similar mechanisms. The campaign architecture is now ecosystem-agnostic.

The targeting choice for the cross-ecosystem move was deliberate. PyTorch Lightning is not just a popular Python package. It is a popular Python package in the AI training ecosystem specifically. Developer machines and CI runners that import Lightning routinely hold credentials for cloud GPU resources, model registries, training data buckets, and the API keys for the ML model providers being fine-tuned. The blast radius of a Lightning compromise reaches the same kind of high-value cloud infrastructure that the GlassWorm extension marketplace compromise reached, but through the ML training pipeline rather than through the developer's IDE. Different vector, same destination.

THE ANTHROPIC CLAUDE CODE IMPERSONATION

One detail in the Shai-Hulud propagation mechanism deserves a separate callout. When the worm pushes stolen credentials to attacker-controlled GitHub repositories, it commits them with author metadata impersonating Anthropic's Claude Code AI coding agent. The commits are authored as "claude@users.noreply.github.com" with commit messages styled to resemble routine Claude Code output. The repository descriptions read "A Mini Shai-Hulud has Appeared," which is the campaign's signature.

This is a meaningful tradecraft evolution. AI coding agents writing commits to GitHub repositories is now common enough that a casual review of repository activity does not flag a Claude Code-attributed commit as suspicious. Defenders who rely on commit author patterns to identify abnormal activity have a new edge case to handle. The attacker's commit metadata can claim AI agent provenance, and the commit looks like routine AI-assisted development unless somebody actually reads the diff. The blast radius of poor commit review extends to anyone using AI coding agents in their pipeline.

The yesterday Atarus thought leadership piece on reordering the OWASP LLM Top 10 argued that the AI infrastructure threat surface needs its own framework treatment. The Claude Code commit impersonation is exactly the kind of tradecraft that lives outside any current AI security framework. It is not prompt injection. It is not excessive agency. It is identity spoofing in version control metadata, weaponized against the assumption that AI agent activity is benign by default. Defenders need to update their threat model.

WHY THIS PATTERN IS ACCELERATING

This is the ninth AI infrastructure compromise the Atarus blog has documented in eleven days. The MCP architectural RCE on April 21. The Mythos vendor breach on April 24. The LMDeploy SSRF exploited in thirteen hours on April 25. The GlassWorm sleeper extensions on April 26. The Itron utility breach on April 27. The Microsoft Entra Agent ID privilege escalation on April 28. The LiteLLM SQL injection exploited in thirty-six hours on April 29. The PocketOS database wipe by an AI coding agent on April 30. The PyTorch Lightning compromise today.

Each one is a different layer. AI tooling protocols and inference servers. Vendor access governance. Marketplaces and gateways. Identity primitives. Operational autonomy. Now ML training framework supply chain. The pattern across all nine is consistent. AI infrastructure is being built and deployed at a pace that outruns the security maturity of the people building it, the platforms hosting it, and the buyers adopting it. Each layer is producing its own catalog of failures. The Shai-Hulud campaign is now treating the entire AI ecosystem as an addressable target, with cross-ecosystem propagation that turns each compromise into a foothold for the next.

The eighteen-minute Socket detection time deserves a positive note in this otherwise grim trend. AI infrastructure security tooling is now operating at the cadence the threat requires. Socket caught the Lightning malware nearly in real time. The Sysdig research that documented the LiteLLM SQL injection caught the first exploitation thirty-six hours after disclosure. The detection cadence in AI infrastructure security is improving. The deployment cadence in AI infrastructure code is not. The gap between the two is where the operational damage lives.

INDICATORS AND TIMELINE

WHAT TO DO IF YOU INSTALLED LIGHTNING YESTERDAY