corpus.blog
41554 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a07df5-49ee-7218-91aa-008e32a80ad3

lightning PyPI Compromise: A Bun-Based Credential Stealer in Python

Snyk · published 30 April 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at snyk.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
32
Words captured
2,932

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://bun.com/
bun.com
https://learn.snyk.io/lesson/compromise-of-legitimate-package
learn.snyk.io
https://pypistats.org/api/packages/lightning/recent
pypistats.org
https://pypistats.org/api/packages/pytorch-lightning/recent
pypistats.org
https://web.archive.org/web/20260218081732/https://pypi.org/project/lightning/
web.archive.org
https://security.snyk.io/vuln/SNYK-PYTHON-LIGHTNING-16323121
security.snyk.io
https://security.snyk.io/package/pip/lightning
security.snyk.io
"A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages Read at the source ↗
snyk.io
https://www.aikido.dev/blog/pytorch-lightning-pypi-compromise-mini-shai-hulud
aikido.dev
https://github.com/e-hokage777/Intron-Afrispeech/blob/master/poetry.lock
github.com
https://github.com/Lightning-AI/pytorch-lightning/blob/master/.github/workflows/release-pkg.yml
github.com
https://github.com/Lightning-AI/pytorch-lightning/issues/21681
github.com
https://github.com/cap-js/cds-dbs/pull/1592
github.com
https://api.github.com/users/pl-ghost
api.github.com
https://api.github.com/users/pl-ghost/events/public
api.github.com
https://github.com/Lightning-AI/pytorch-lightning/issues/21689
github.com
https://github.com/Lightning-AI/pytorch-lightning/issues/21690
github.com
https://github.com/Lightning-AI/pytorch-lightning/issues/21691
github.com
https://github.com/Lightning-AI/pytorch-lightning/issues/21692
github.com
Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack Read at the source ↗
snyk.io
npm Supply Chain Attack via Open Source maintainer compromise Read at the source ↗
snyk.io
Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers Read at the source ↗
snyk.io
How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM Read at the source ↗
snyk.io
SHA1-Hulud, npm supply chain incident Read at the source ↗
snyk.io
The Holiday Whisper: Shai-Hulud 3.0 Read at the source ↗
snyk.io
Beyond Detection: Building a Resilient Software Supply Chain (Lessons from the Shai-Hulud Post-Mortem) Read at the source ↗
snyk.io
https://security.snyk.io/
security.snyk.io
https://app.snyk.io/auth/auth0/waad
app.snyk.io
https://app.snyk.io/auth/docker
app.snyk.io
https://app.snyk.io/auth/auth0/bitbucket
app.snyk.io
https://snyk.io/policies/terms-of-service/
snyk.io
https://snyk.io/policies/privacy/
snyk.io