lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-09T20:52:08Z•a4441cf1de59a6fd1dade2e210b75354a24116afb2b093002a6e11c0857e8a22
Atlassian integrationCI/CDCVE-2026-40478GitHub Actions compromiseIoCsMini Shai-HuludPyPI compromiseSSH keysSnyk advisoriesThymeleafbunbun-based stealercloud-credentialscredential theftdbthigh-severitymalicious releasenpm compromiseremediationrotate-credentialssupply-chaintemplate-injection
What happened
Snyk blog posts report multiple high‑risk supply‑chain incidents and one high‑severity template injection: 1) Malicious PyPI packages (notably lightning and elementary-data v0.23.3) contained Bun‑based credential‑stealers that execute on import and exfiltrate cloud provider keys, dbt profiles, SSH secrets and other developer credentials; attackers published elementary-data via a GitHub Actions script‑injection. 2) A related Bun‑based stealer (“Mini Shai‑Hulud”) compromised several npm packages in the SAP ecosystem (cap-js, mbt). Snyk provides live advisories, technical breakdowns and IOCs. 3)A
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- a4441cf1de59a6fd1dade2e210b75354a24116afb2b093002a6e11c0857e8a22
- Enrichment time
- 2026-05-09T20:52:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.