lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-05T08:52:04Z•1d20434e5e8421dad5eb76742a133254915ed8e872bcc75077105750eea29635
CI/CDCVE-2026-40478GitHub-ActionsPyPISnykbuncredential-theftmalicious-packagenpmpatchingrotate-keyssecret-exposuresupply-chainthreat-advisory
What happened
Multiple late-April 2026 supply-chain incidents and a high-severity template-injection vulnerability were disclosed by Snyk. Attackers published malicious PyPI and npm releases (notably the lightning and elementary-data PyPI packages and multiple SAP-related npm packages) that include a Bun-based credential stealer running on import and backdoors that exfiltrate cloud provider keys, dbt profiles, SSH secrets and other CI/DevOps credentials. One separately disclosed high-severity Thymeleaf template injection (CVE-2026-40478, CVSS ~9.1) requires immediate patching to 3.1.4+ and audit of dynamic/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- 1d20434e5e8421dad5eb76742a133254915ed8e872bcc75077105750eea29635
- Enrichment time
- 2026-05-05T08:52:04Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.