lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-04T20:52:07Z•959aba9f3ba9634ea9eb7442c3333256a6d5adb423c6143835f93125a5b9b2d3
BunCVE-2026-40478GitHub ActionsIOCsMini Shai-HuludPyPISAPSnyk-advisoryThymeleafcap-jscloud-credentialscredential-stealerelementary-datalightningmbtnpmpatchingremediationrotate-keyssupply-chaintemplate-injection
What happened
Feed of Snyk blog advisories (Apr 27–30, 2026) describing multiple supply-chain incidents and a critical template-injection CVE. Key incidents: a malicious release of the lightning PyPI package that runs a Bun-based credential stealer on import; a separate malicious PyPI release (elementary-data v0.23.3) that exfiltrates dbt profiles, cloud provider keys and SSH secrets via a compromised GitHub Actions workflow; and a Bun-based "Mini Shai-Hulud" npm campaign that compromised SAP ecosystem packages including @cap-js and mbt. Also includes CVE-2026-40478 (Thymeleaf template injection, CVSS 9.1)—
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- 959aba9f3ba9634ea9eb7442c3333256a6d5adb423c6143835f93125a5b9b2d3
- Enrichment time
- 2026-05-04T20:52:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.