How the PyTorch Lightning Community Discovered a Supply Chain Attack and Fixed it in 42 Minutes

Affected Versions: lightning 2.6.2, 2.6.3 (via PyPI only)
Timeline: Affected versions were installable between 12:45:20 and 13:27:30 UTC on April 30, 2026
Status: Actively contained. Upgrade to 2.6.1 now; 2.6.4 coming shortly

On April 30, 2026, an attacker captured PyPI credentials and used them to push compromised versions of PyTorch Lightning (PTL). These versions were live for 42 minutes before PTL community members alerted us and PyPI quarantined the package. The PyTorch Lightning GitHub source code repository was never compromised. This affected those who installed PTL via PyPI between 12:45:20 and 13:27:30 UTC on April 30th, 2026.

Our Community Caught This, and We Moved Fast

That speed was only possible because of you. Community members flagged the suspicious behavior, independently reported it to PyPI, and PyPI acted swiftly to limit the attack vector by quarantining the affected packages after 42 minutes.

Vulnerability scanning services including socket.dev also detected the attack, reported to us on GitHub and Discord, and published detailed technical analysis that aided our response. This is open source security working exactly as it should: thousands of technically sharp eyes watching, and a community that acts when something looks wrong.

Your swift alerts helped us keep others safe.

Our Repo Wasn't Compromised, Here's What Was

The attack targeted the distribution layer, not the source. The attack never compromised our GitHub source code repository. If you visit our GitHub repository now, versions 2.6.2 and 2.6.3 contain no malicious code because the attacker never touched our codebase.

The threat compromised our PyPI publishing channel. An attacker with access to our PyPI credentials cloned our open source code, injected a malicious payload, and pushed those tampered builds directly to PyPI as malicious versions 2.6.2 and 2.6.3, bypassing our source control entirely. Any user who pip installed or updated to either of those versions received the attacker's build, not ours.

Both versions have now been quarantined from PyPI. Our security advisory will remain active and will be updated with a CVE once one is assigned. For the full technical record and remediation checklist, see our official security advisory.

How the Supply Chain Attack Worked

The malicious builds contained a credential harvesting payload that executed silently the moment the package was imported. On import lightning, the following attack chain ran in the background:

1. A hidden background thread was spawned at import time via __init__.py
2. The thread downloaded and installed Bun, a JavaScript runtime
3. An obfuscated (~11MB) JavaScript payload executed, targeting:

• AWS, GCP, and Azure credentials
• Browser-stored credentials (Chrome, Firefox, Brave)
• .env files
• GitHub tokens

Stolen data was exfiltrated to an attacker-controlled command-and-control server.

Immediate Actions to Take

If you imported lightning 2.6.2 or 2.6.3 in any environment, including CI/CD pipelines, treat that environment's secrets as compromised and stop using 2.6.2 and 2.6.3 immediately. These versions have been quarantined from PyPI. They should not be used under any circumstances. Then:

1. Downgrade to 2.6.1 for the time being:

  pip install lightning==2.6.1

1. Rotate all credentials that may have been present in any environment where 2.6.2 or 2.6.3 were imported. This includes:
2. Audit your environment variables for any secrets that were exposed at runtime.
3. Review your CI/CD logs for any unexpected outbound network connections.

If you need to scan systems or build artifacts for indicators of compromise, the following SHA256 hashes correspond to the malicious files identified in versions 2.6.2 and 2.6.3:

What We Are Doing

Our team is executing a full incident response across three parallel workstreams:

Containment: We have revoked and are rotating all compromised credentials. Versions 2.6.2 and 2.6.3 have been quarantined from PyPI. We have regained control of our PyPI publishing access.

Blast Radius Assessment: We are actively working to understand how many downloads happened, which environments were affected, and the full scope of credential exposure. Once the investigation is complete, an update will be released in this article and on our GitHub.

Incident Management & Disclosure: We are committed to full transparency throughout this process. We published a security advisory immediately upon confirmation of the incident and will continue to update it as our investigation develops.

Next Steps

Once containment is complete and we have a clear picture of the blast radius, we will release version 2.6.4 as the new recommended release. Even though the source code behind 2.6.2 and 2.6.3 on GitHub was never compromised, those version numbers are now tainted. We are retiring them and will not re-publish under those identifiers.

We will also publish a full post-mortem once the investigation concludes, including the root cause and the process changes we are implementing to prevent recurrence.

Full Security Advisory

For complete technical details, indicators of compromise, and remediation guidance, see our official security advisory: GHSA-w37p-236h-pfx3 — Compromise of PyTorch Lightning PyPI Package Versions

A Note on Open Source

Incidents like this are a painful reminder of why the open source model works. Within minutes, our community found, reported, and escalated this issue helped stop the damage from spreading. A closed-source vendor can't say the same. The speed witnessed today was only possible because thousands of experts in this community have eyes on our software 24/7/365.

We take this seriously. We are committed to earning back full confidence in the security of our distribution pipeline, and we will be transparent every step of the way.

-The Lightning AI Team