lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-03T08:52:01Z•12e12853c59c745e806076775960371b8188c102ef567f0d51387dd627cc73b3
CVE-2026-40478GitHub ActionsIOCPyPISAPThymeleafbackdoorbuncloud-credentialscredential-rotationcredential-stealernpmpatchingremediationsupply-chaintemplate-injection
What happened
Multiple supply-chain incidents and a high-severity template-injection were reported by Snyk in late April 2026. Malicious PyPI releases (lightning, elementary-data) and a related npm campaign (“Mini Shai‑Hulud”) delivered a Bun-based credential stealer that executes on import and exfiltrates cloud provider keys, dbt profiles, SSH secrets and other developer credentials; one PyPI compromise abused a GitHub Actions script-injection to publish a backdoored release. Separately, Thymeleaf template injection (CVE-2026-40478, CVSS 9.1) is exploitable only when applications evaluate untrusted dynamic
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- 12e12853c59c745e806076775960371b8188c102ef567f0d51387dd627cc73b3
- Enrichment time
- 2026-05-03T08:52:01Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.