AI’s Supply Chain Nightmare: The Lightning Framework Worm and the “Silence Developer” Meme

Security researchers report that Lightning versions 2.6.2 and 2.6.3 were backdoored with a self‑propagating worm that executes on import, downloads the Bun JavaScript runtime, and runs an obfuscated payload which harvests GitHub/npm/cloud credentials, poisons repositories, and injects postinstall hooks into npm tarballs to spread; the attackers also appear to have compromised a maintainer GitHub account and posted Tor links claiming ties to extortion groups. Socket recommends immediate removal of the malicious releases, downgrading to 2.6.1, rotating exposed credentials, auditing repositories for unauthorized commits and hidden directories, and inspecting local npm artifacts.