lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-03T20:52:04Z•d748875bde8e0100165fd13cdeda74a35dba5b4bcd41721efc0d5943d04c051e
Bun-based stealerCVE-2026-40478GitHub ActionsIoCsMini Shai-HuludPyPI compromiseThymeleafcloud credentialscredential theftelementary-datalightningnpm compromisepatchingrotate-keyssupply-chaintemplate injection
What happened
Snyk published multiple advisories covering active supply-chain attacks and a high-severity template-injection flaw. A malicious release of the lightning PyPI package contains a Bun-based credential stealer that executes on import; this pattern ties to the “Mini Shai-Hulud” Bun-based stealer that compromised several SAP-related npm packages (cap-js, mbt). Separately, a malicious release of the elementary-data PyPI CLI (v0.23.3) — introduced via a GitHub Actions script injection — exfiltrated dbt profiles, cloud provider keys, and SSH secrets. Snyk also warns of CVE-2026-40478 (Thymeleaf templ
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- d748875bde8e0100165fd13cdeda74a35dba5b4bcd41721efc0d5943d04c051e
- Enrichment time
- 2026-05-03T20:52:04Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.