lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
2026-05-01T20:51:59Z•fdc79f42025c9c2857e48e4db0b02d7b3d15acef6fd98e13edaa3e3e62840391
BunCVE-2026-40478GitHub ActionsIOCsPyPISSHSnyk-advisoryThymeleafbackdoorcloud-credentialscredential-stealerdbtnpmpackage-compromiseremediationsupply-chaintemplate-injection
What happened
Snyk published multiple supply-chain and code-injection incidents: a malicious lightning PyPI release contains a Bun-based credential stealer that executes on import; a separate malicious elementary-data PyPI release (v0.23.3) implanted a backdoor via a GitHub Actions script-injection to exfiltrate dbt profiles, cloud provider keys and SSH secrets; and a Mini Shai-Hulud Bun-based stealer compromised SAP-related npm packages (cap-js, mbt). Snyk also published a high-severity Thymeleaf template injection (CVE-2026-40478, CVSS 9.1) that is exploitable when applications evaluate untrusted dynamic/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- fdc79f42025c9c2857e48e4db0b02d7b3d15acef6fd98e13edaa3e3e62840391
- Enrichment time
- 2026-05-01T20:51:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.