Story
Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library
1 report
1 website
1 discussion
Latest report
Overview
The PyPI package 'lightning', versions 2.6.2 and 2.6.3, was compromised in a supply chain attack, affecting users of the PyTorch Lightning AI training library. The malicious versions include a hidden _runtime directory containing obfuscated JavaScript that activates upon running pip install lightning.
Summary from semgrep.dev.
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · semgrep.dev
Hacker News discussion ↗
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-04-30.
- Concern: The discovery of malware in the PyTorch Lightning library raises significant concerns about the security of AI training tools, potentially jeopardizing user trust and safety.
- Concern: The rapid creation of repositories with compromised names indicates a serious security breach, suggesting that the integrity of AI development environments is at risk.
- Concern: Uncertainty about how the dependency was compromised highlights vulnerabilities in the approval processes for AI libraries, which could lead to widespread issues if not addressed.