# lightning: Obfuscated JavaScript Credential Stealer Bundled in PyPI Wheel

Malicious lightning PyPI wheels 2.6.2/2.6.3 run a daemon thread on import that fetches Bun and an obfuscated JS stealer, exfiltrating credentials via GitHub commits.

- Payout: Real-world hack
- Severity: critical
- Program: lightning
- Analysis by: StepSecurity
- Disclosed: 2026-05-04
- Write-up quality: 6/10
- Original: https://www.stepsecurity.io/blog/lightning-obfuscated-javascript-credential-stealer-bundled-in-pypi-wheel
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-lightning-obfuscated-javascript-credential-stealer-bundled-in-pypi-wheel
- Tags: area:oss domain:oss impact:data-leak impact:integrity kind:incident platform:threat-intel sev:critical tech:github-actions tech:nodejs tech:python technique:source-review vuln:secrets-leak

**Target:** PyPI package wheel (Python import hook + downloaded JS runtime)
**Root cause:** Compromised PyPI publishing credentials and GitHub token allowed malicious wheels to ship a hidden _runtime/ directory whose start.py downloads the Bun runtime from GitHub and executes an 11 MB obfuscated router_runtime.js.
**Steps:**
1. Install lightning 2.6.2 or 2.6.3 from PyPI (last clean release 2.6.1).
2. On `import lightning`, a daemon thread with suppressed stdout/stderr runs `_runtime/start.py`.
3. start.py downloads the Bun JavaScript runtime binary from GitHub.
4. Bun executes `_runtime/router_runtime.js`, an 11 MB obfuscated payload.
5. Payload harvests tokens, env vars, cloud secrets; commits encoded data to GitHub repos via victim's token; poisons local npm tarballs.
**How found:** Analysts diffed wheels against last clean release 2.6.1, spotted hidden _runtime/ directory and import-time daemon thread, then statically analyzed router_runtime.js (703+ process/env refs, 463+ token refs, 336+ repo refs); GitHub issue #21689 closed suspiciously indicated account compromise.
**Exploitation:** Attacker with PyPI publishing credentials and a GitHub token published trojanized wheels; import alone triggers silent background execution that steals credentials and cloud secrets, exfiltrates via GitHub API commits under the victim's identity, and injects malicious code into npm tarballs on the developer machine to spread downstream.
**Escalation:** Payload self-propagates by poisoning npm package tarballs on the victim's machine, extending compromise from PyPI consumers to downstream npm consumers.
**Insight:** Diff new package releases against the last clean version and grep for hidden directories plus import-time thread/network calls; runtime-downloaded obfuscated JS (Shai-Hulud pattern) hides payload from wheel-only static analysis, so monitor child processes fetching external runtimes.