discovered
pytorch-lightning is identified in the SafeDep analysis "PyTorch Lightning Compromised: Shai-Hulud Worm Reaches PyPI". PyPI yanked PyTorch Lightning versions 2.6.2 and 2.6.3 after both embedded a two-stage credential-stealing payload. Any import of the library spawns an 11MB obfuscated JavaScript worm identical to the Shai-Hulud payload seen in the April 29 SAP npm campaign.