lightning PyPI Compromise: A Bun-Based Credential Stealer in Python

2026-04-30来源 Snyk BlogEnglish
lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
A malicious release of the lightning PyPI package ships a credential-stealing Bun payload that runs on import. Snyk has a live advisory. Here's what's in the package, what to rotate, and how the payload pattern connects to the Mini Shai-Hulud npm campaign one day earlier.

原文：https://www.a8q9.cn/en/article/lightning-pypi-compromise-a-bun-based-credential-stealer-in-python-ea6baf.html

相关文章