A supply chain attack hit the ML training stack
Shai-Hulud malware compromised PyTorch Lightning on PyPI (versions 2.6.2 and 2.6.3), injecting credential-stealing code and poisoning GitHub repositories, per Semgrep's analysis. Supply chain attacks on package managers are not new — but this one targeted an ML-specific library, giving attackers a path to model weights and cloud credentials, not just application code.
ML training dependencies are now attractive attack targets because compromising one package can expose model weights, cloud credentials, and CI/CD pipelines simultaneously.
The incident was detected within days by Semgrep, and teams running dependency pinning with hash verification were not affected. The attack vector is the same one PyPI has always had — this is not a novel threat class.
Platform engineers, security architects, ML infrastructure teams.
If you use PyTorch Lightning, audit versions 2.6.2 and 2.6.3 immediately, rotate credentials on affected systems, and verify GitHub repository integrity for projects that pulled these versions.