This is a textbook maintainer account compromise with cross-ecosystem tooling transfer. Let me break down what I'm seeing.
First, the blast radius. PyTorch Lightning is a critical infrastructure package — millions of monthly downloads from the ML/data science community. These weren't typosquats or dependency confusion — this was a legitimate package compromise. Socket caught it at 18 minutes, but with hundreds of thousands of daily downloads and automated CI/CD pipelines worldwide pulling updates automatically, we're looking at substantial exposure even in that narrow window. The ML ecosystem is particularly vulnerable here because research environments often run pip install --upgrade lightning as part of notebook workflows and CI pipelines, and many data scientists aren't running SCA scanning in their research VPCs.
Now, the execution chain is critical. According to the sources, this executes on import, not during installation. You pip install lightning==2.6.2 and nothing happens. But the moment someone runs import lightning or from lightning import..., the hidden _runtime/start.py triggers. It downloads Bun runtime from GitHub, pulls an 11.4 MB obfuscated JavaScript payload (router_runtime.js), and the credential harvesting begins. SSH keys, shell history, cloud credentials for AWS/GCP/Azure, GitHub tokens, npm tokens, crypto wallets — the full kit. The GitHub dead-drop exfiltration is sophisticated: it uses stolen GitHub tokens to commit encoded data to attacker-controlled repositories.
On TeamPCP's cross-ecosystem capabilities — this is the smoking gun. The Mini Shai-Hulud infrastructure was originally seen in npm attacks (SAP packages, Bitwarden CLI), and now it's practically identical on PyPI. Same Bun runtime, same JavaScript payload structure, same GitHub-based exfiltration, same dead-drop methodology. This suggests they've developed registry-agnostic tooling that can operate across package ecosystems. The payloads are portable — they're not ecosystem-specific, just delivery vectors with different hooks.
For audit and cleanup: Teams need to pip show lightning immediately. If you're on 2.6.2 or 2.6.3, that's game over for that environment. But it gets worse — the malware exfiltrates credentials, so anyone who imported the package anywhere needs to rotate everything: SSH keys, GitHub tokens, cloud IAM credentials, npm publish tokens, crypto wallet keys. Check history for gh auth status changes and look for suspicious Git commits in any repositories linked to that environment. Also audit for those attacker-controlled GitHub repos used as dead-drops — even knowing which ones were targeted gives you an IOC list.
Edit: Looking more closely at the timeline — this follows the LiteLLM compromise pattern from March, Telnyx in April, now Lightning in late April. TeamPCP is hitting PyPI systematically with the same tooling infrastructure. The trust failure point here is maintainer account compromise, not code-level vulnerabilities. The source repos are clean — this happened at the registry level.