lightning PyPI Package Compromised in Supply Chain Attack

The popular PyPI package lightning has been compromised in a supply chain attack affecting newly published versions of the package. Socket has classified lightning versions 2.6.2 and 2.6.3 as malicious. Version 2.6.1, published on January 30, 2026, is clean. Version 2.6.2, published on April 30, 2026, introduced malicious code into the legitimate library. Socket’s AI scanner flagged both versions 2.6.2 and 2.6.3as potentially malicious eighteen minutes after publication. The compromise affects…