lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-10T20:52:04Z•ad4383da3bf83411c22c9a710d6df1c44da0df2c402ca886c7029d353923b9e1
CVE-2026-40478GitHub ActionsIOCsMini Shai-HuludPyPISAPThymeleafadvisorybuncap-jscloud-credentialscredential-stealerdbtelementary-datalightningmbtnpmpackage-tamperingpatchingrotate-keysssh-keyssupply-chaintemplate-injection
What happened
Multiple late‑April 2026 supply‑chain incidents and a high‑severity template injection were reported by Snyk: a malicious lightning PyPI release contains a Bun‑based credential stealer that runs on import; a "Mini Shai‑Hulud" Bun stealer compromised several SAP npm packages (including cap-js and mbt); a malicious elementary-data PyPI release (v0.23.3) delivered a backdoor via a GitHub Actions script injection targeting dbt profiles, cloud provider keys and SSH secrets; and a conditional Thymeleaf template injection (CVE-2026-40478, CVSS 9.1) requires patching to 3.1.4+. Snyk has live advisoriе
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- ad4383da3bf83411c22c9a710d6df1c44da0df2c402ca886c7029d353923b9e1
- Enrichment time
- 2026-05-10T20:52:04Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.