TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

The Hacker News

PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials

[email protected] (The Hacker News) · 5 days ago · Read original ↗

ATT&CK techniques detected

19 predictions
T1195.001Compromise Software Dependencies and Development Tools
100%
“pytorch lightning and intercom - client hit in supply chain attacks to steal credentials in yet another software supply chain attack, threat actors have managed to compromise the popular python package lightning to push two malicious versions to conduct credential theft. accordin…”
T1195.001Compromise Software Dependencies and Development Tools
99%
“malware implements an npm - based propagation vector that modifies the developer ' s local npm packages with a postinstall hook in the " package. json " file to invoke the malicious payload, increases the patch version number, and repacks the. tgz tarballs. should the unsuspectin…”
T1195.001Compromise Software Dependencies and Development Tools
99%
“installed. it ' s also essential to downgrade to the last known clean version, 2. 6. 1, and rotate credentials exposed in affected environments. the supply chain attack is the latest addition to a long list of compromises carried out by a threat actor known as teampcp, which has …”
T1195.001Compromise Software Dependencies and Development Tools
98%
“said. " the execution chain runs automatically when the lightning module is imported, requiring no additional user action after installation and import. " the attack chain paves the way for a python script ( " start. py " ), which downloads and executes the bun javascript runtime…”
T1195.001Compromise Software Dependencies and Development Tools
96%
“to modify and republish packages containing the malware, in addition to writing the payload files to paths like ". claude / settings. json " and ". vscode / tasks. json. " " the php payload mirrors the broader mini shai - hulud tradecraft observed across recent npm and pypi compr…”
T1195.001Compromise Software Dependencies and Development Tools
95%
“and sustained rather than opportunistic. the repeated use of install - time execution, bun - based payload delivery, obfuscated ' router _ runtime. js, ' credential harvesting, github abuse, and package / repository propagation shows a campaign built to turn one compromised devel…”
T1195.001Compromise Software Dependencies and Development Tools
86%
“means of a shell script ( " setup - intercom. sh " ) that ' s triggered during install or update events ( via the " post - install - cmd " and " post - update - cmd " hooks ) and launches an obfuscated " router _ runtime. js " credential - stealing payload. the malware component,…”
T1587Develop Capabilities
75%
“pytorch lightning and intercom - client hit in supply chain attacks to steal credentials in yet another software supply chain attack, threat actors have managed to compromise the popular python package lightning to push two malicious versions to conduct credential theft. accordin…”
T1195.001Compromise Software Dependencies and Development Tools
73%
“operandi as that of the sap packages to trigger the execution of a credential - stealing malware using a preinstall hook. " the overlap is significant because the sap cap campaign was linked to teampcp activity based on shared technical details, including distinctive payload impl…”
T1195.002Compromise Software Supply Chain
73%
“installed. it ' s also essential to downgrade to the last known clean version, 2. 6. 1, and rotate credentials exposed in affected environments. the supply chain attack is the latest addition to a long list of compromises carried out by a threat actor known as teampcp, which has …”
T1587Develop Capabilities
71%
“said. " the execution chain runs automatically when the lightning module is imported, requiring no additional user action after installation and import. " the attack chain paves the way for a python script ( " start. py " ), which downloads and executes the bun javascript runtime…”
T1587Develop Capabilities
63%
“installed. it ' s also essential to downgrade to the last known clean version, 2. 6. 1, and rotate credentials exposed in affected environments. the supply chain attack is the latest addition to a long list of compromises carried out by a threat actor known as teampcp, which has …”
T1059.004Unix Shell
60%
“means of a shell script ( " setup - intercom. sh " ) that ' s triggered during install or update events ( via the " post - install - cmd " and " post - update - cmd " hooks ) and launches an obfuscated " router _ runtime. js " credential - stealing payload. the malware component,…”
T1587Develop Capabilities
58%
“to modify and republish packages containing the malware, in addition to writing the payload files to paths like ". claude / settings. json " and ". vscode / tasks. json. " " the php payload mirrors the broader mini shai - hulud tradecraft observed across recent npm and pypi compr…”
T1587Develop Capabilities
46%
“malware implements an npm - based propagation vector that modifies the developer ' s local npm packages with a postinstall hook in the " package. json " file to invoke the malicious payload, increases the patch version number, and repacks the. tgz tarballs. should the unsuspectin…”
T1195.001Compromise Software Dependencies and Development Tools
45%
“versions 2. 6. 2 and 2. 6. 3, bypassing our source control entirely. any user who pip installed or updated to either of those versions received the attacker ' s build, not ours. " ( the story was updated after publication to reflect the latest developments and include additional …”
T1195.002Compromise Software Supply Chain
39%
“to modify and republish packages containing the malware, in addition to writing the payload files to paths like ". claude / settings. json " and ". vscode / tasks. json. " " the php payload mirrors the broader mini shai - hulud tradecraft observed across recent npm and pypi compr…”
T1195.002Compromise Software Supply Chain
35%
“means of a shell script ( " setup - intercom. sh " ) that ' s triggered during install or update events ( via the " post - install - cmd " and " post - update - cmd " hooks ) and launches an obfuscated " router _ runtime. js " credential - stealing payload. the malware component,…”
T1195.002Compromise Software Supply Chain
35%
“operandi as that of the sap packages to trigger the execution of a credential - stealing malware using a preinstall hook. " the overlap is significant because the sap cap campaign was linked to teampcp activity based on shared technical details, including distinctive payload impl…”

Summary

In yet another software supply chain attack, threat actors have managed to compromise the popular Python package Lightning to push two malicious versions to conduct credential theft. According to Aikido Security, OX Security, Socket, and StepSecurity, the two malicious versions are versions 2.6.2 and 2.6.3, both of which were published on April 30, 2026. The campaign is assessed to be an