lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-09T08:52:18Z•3d95d533097b69672ecff3434930cc389c8f6e366326807998423eae345a9589
AtlassianBunCVE-2026-40478GitHub ActionsJiraMini Shai-HuludPyPISAPSSH-keysSnykThymeleafcloud-credentialscredential-stealerdbtelementary-dataintelligent-remediationlightningnpmpackage-typosquattingpatchingremediationsupply-chaintemplate-injection
What happened
Snyk published multiple advisories about active supply-chain attacks and a high-severity template-injection flaw. Several malicious PyPI/npm releases (notably a ‘lightning’ PyPI package and the ‘Mini Shai‑Hulud’ Bun-based stealer affecting SAP-related npm packages) deliver Bun-based credential-stealing payloads that exfiltrate cloud credentials, dbt profiles, and SSH keys; one PyPI malicious release (elementary-data v0.23.3) was pushed via a GitHub Actions script-injection. Separately, Thymeleaf template injection (CVE-2026-40478, CVSS 9.1) is conditionally exploitable — patch to 3.1.4+ and re
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- 3d95d533097b69672ecff3434930cc389c8f6e366326807998423eae345a9589
- Enrichment time
- 2026-05-09T08:52:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.