Malicious PyTorch Lightning Packages Found on PyPI

Two malicious versions of the widely used pytorch‑lightning package (2.6.2 and 2.6.3) were published to PyPI on April 30, 2026 after the maintainer account was compromised. The packages contain code that executes on import to steal developer credentials and automatically republish infected packages to repositories where the stolen tokens grant access, representing a self‑propagating open‑source supply‑chain malware campaign. Users are advised to verify they are using version 2.6.1 and follow the project's advisory.