# lightning PyPI Compromise: A Bun-Based Credential Stealer in Python

DevFeed: [lightning PyPI Compromise: A Bun-Based Credential Stealer in Python](<https://devfeed.tech/articles/lightning-pypi-compromise-a-bun-based-credential-stealer-in-python-8001.md>)

Original publisher: [Read original article](<https://snyk.io/blog/lightning-pypi-compromise-bun-based-credential-stealer/>)

Author: Stephen Thoemmes

Published: 2026-04-30T00:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Python](<https://devfeed.tech/topics/python.md>), [Bun](<https://devfeed.tech/topics/bun.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [snyk-learn](<https://devfeed.tech/topics/snyk-learn.md>), [npm](<https://devfeed.tech/topics/npm.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [article](<https://devfeed.tech/tags/article.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [code](<https://devfeed.tech/tags/code.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [github](<https://devfeed.tech/tags/github.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [payload](<https://devfeed.tech/tags/payload.md>), [python](<https://devfeed.tech/tags/python.md>), [release](<https://devfeed.tech/tags/release.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [security-labs](<https://devfeed.tech/tags/security-labs.md>), [snyk-learn](<https://devfeed.tech/tags/snyk-learn.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-security-intel](<https://devfeed.tech/tags/snyk-security-intel.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [tech](<https://devfeed.tech/tags/tech.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

A compromised lightning PyPI release downloads the Bun JavaScript runtime at import time and executes an approximately 11 MB obfuscated credential stealer. The article covers the package compromise, Snyk advisory, remediation, and similarities to the preceding Mini Shai-Hulud npm campaign.

## Source excerpt

A malicious release of the lightning PyPI package ships a credential-stealing Bun payload that runs on import. Snyk has a live advisory. Here's what's in the package, what to rotate, and how the payload pattern connects to the Mini Shai-Hulud npm campaign one day earlier.