lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-11T20:52:07Z•25dd003382e5d3bce54856d264c9bcb2de79967bc405f75c10faa87e95b31954
CI compromiseCVE-2026-40478GitHub ActionsIOCsPyPISAPSSH-keysThymeleafbackdoorbuncloud-credentialscredential-theftdbtnpmremediationrotate-credentialssnyk-advisorystealersupply-chaintemplate-injection
What happened
Snyk published multiple late-April-2026 advisories about supply-chain attacks and a high-severity template injection. Malicious PyPI releases (lightning, elementary-data) and a bun-based npm stealer ("Mini Shai-Hulud") delivered credential-stealing payloads on import or via compromised CI (GitHub Actions), targeting cloud provider keys, dbt profiles, SSH secrets and developer credentials. Snyk released technical breakdowns, IOCs and mitigation guidance (revoke/rotate affected secrets, audit code/CI, remove malicious packages). Separately, Thymeleaf template injection CVE-2026-40478 (CVSS 9.1)—
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- 25dd003382e5d3bce54856d264c9bcb2de79967bc405f75c10faa87e95b31954
- Enrichment time
- 2026-05-11T20:52:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.