Supply-chain attacksBriefConfirmed by two or more outlets
PyTorch Lightning PyPI compromise (2.6.2 / 2.6.3)
Publisher account takeover. Live 42 minutes.
- Disclosed
What happened
- Publisher account takeover. Live 42 minutes. Bun-based credential stealer linked to TeamPCP. Intercom-client was hit too.
Sources
- https://thehackernews.com/2026/04/pytorch-lightning-compromised-in-pypi.html
- https://snyk.io/blog/lightning-pypi-compromise-bun-based-credential-stealer/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.