Lightning Python Package Supply Chain Attack

Popular Python machine learning package Lightning was compromised in April 2026 with malicious versions 2.6.2 and 2.6.3 published to steal developer credentials and sensitive data. This incident highlights ongoing supply chain risks in the Python ecosystem affecting thousands of projects.