{
  "Event": {
    "analysis": "1",
    "date": "2026-04-30",
    "extends_uuid": "",
    "info": "[Threat Intel] PyPI Package Compromised in Supply Chain Attack",
    "protected": false,
    "publish_timestamp": "1779546304",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1779546304",
    "uuid": "565a848a-339a-4b80-9b8f-77554ccc117a",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"Shai-Hulud\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:online-service=\"3b16bb5a-eb4f-4603-a909-bebc5df4a46d\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1777950033",
        "to_ids": false,
        "type": "link",
        "uuid": "970b0119-b9de-469f-b348-7e12fb4272b8",
        "value": "https://socket.dev/blog/lightning-pypi-package-compromised",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1777950033",
        "to_ids": false,
        "type": "text",
        "uuid": "babadcac-825a-41cd-9b27-7ad7c40f9edb",
        "value": "The popular PyPI package lightning experienced a supply chain attack affecting versions 2.6.2 and 2.6.3, published on April 30, 2026. The compromise introduced malicious code that executes automatically upon module import, downloading Bun JavaScript runtime and executing an 11MB obfuscated payload. The attack harvests credentials including GitHub tokens, npm tokens, cloud credentials from AWS, Azure, and Google Cloud, while targeting CI/CD environments. The malicious code poisons GitHub repositories by injecting backdoored files impersonating Claude Code commits and infects local npm packages through tarball manipulation. The attack shows similarities to previous Shai-Hulud campaigns in terms of credential targeting and obfuscation methods. Evidence suggests the maintainer's GitHub account (pl-ghost) was compromised, with suspicious branch operations and disclosure suppression indicating ongoing attacker control. The incident affects a widely-used deep learning framework receiving millions of monthly downl..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1777950033",
        "to_ids": false,
        "type": "text",
        "uuid": "8ef26f93-d431-48c7-a857-ff47e908d476",
        "value": "Name: PyPI Package Compromised in Supply Chain Attack\nAuthor: AlienVault\nAdversary: Team PCP\nTags: [\"npm worm\", \"pypi\", \"shai-hulud\", \"ci/cd targeting\", \"supply chain attack\", \"github poisoning\"]\nTgtd countries: []\nMlwr families: [\"router_runtime.js\"]\nAttack_ids: []\nIndustries: [\"Technology\"]"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1777950033",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "17b0eb3a-bbeb-4ac8-950b-7ec8f4a0c2b8",
        "value": "Team PCP"
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1779546304",
        "uuid": "7e528210-b94f-4950-bbf0-4294fbdaf820",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1779546303",
            "to_ids": true,
            "type": "md5",
            "uuid": "41e09b4b-7efc-4595-9606-9c17d15c4b73",
            "value": "40d0f21b64ec8fb3a7a1959897252e09",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1779546304",
            "to_ids": true,
            "type": "sha1",
            "uuid": "306c90e1-b6be-4641-8732-44611552f771",
            "value": "f1b3e7b3eec3294c4d6b5f87854a52471f03997f",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1779546304",
            "to_ids": true,
            "type": "sha256",
            "uuid": "43b3f09f-b1d3-4fdb-abc7-07be780c6512",
            "value": "5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1778621548",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6afe4030-2e85-4165-a076-d3bf48dfec35",
            "value": "49152:Lp98fNjeQUduxxhyos3gRIRPmyGQiHzgPqoLy+W27MuaxsrtubZYEnykpwW1A1Xq:EDCWD2mX"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1778621548",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "eead7efd-bbb8-47c0-bfcc-39e978cc8898",
            "value": "11448921"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1778621548",
            "to_ids": true,
            "type": "vhash",
            "uuid": "3e78bb81-3bf6-4517-8200-0053d7507401",
            "value": "bd6867564df924de1feb5b91bdc5a6e9"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1778621548",
            "to_ids": true,
            "type": "filename",
            "uuid": "04df98c3-7fdb-41fe-a680-28dfe05ac461",
            "value": "router_runtime.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 13/05/2026\nLast-scan\t:  12/05/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1778621548",
            "to_ids": false,
            "type": "text",
            "uuid": "018a61ce-23b1-426a-a1c5-2bcabe79ef15",
            "value": "Type Description: JavaScript\nMicrosoft: Trojan:JS/ShaiWorm!rfn\nVT Total Detection:29/61\nFirst Submission:2026-04-30T13:05:01.000000+00:00\nLast Submission:2026-04-30T13:15:50.000000+00:00"
          }
        ]
      }
    ]
  }
}