Malicious versions 2.6.2 and 2.6.3 of the PyTorch Lightning package were uploaded to PyPI, after the publisher's account was compromised. These packages, published on April 30, 2026, contained malicious code designed to steal developer credentials. Importing the package activates a background process that executes a large, obfuscated JavaScript payload. This payload targets multi-cloud services like AWS, Azure, and Google Cloud, along with GitHub APIs. The malware also downloads a secondary payload from attacker-controlled infrastructure. The attack is particularly dangerous because it used a compromised version of a trusted package. Attackers quickly released version 2.6.3 to evade detection after version 2.6.2 was flagged. Small changes, like metadata updates, were used to avoid triggering security measures. Users who installed these versions should treat their systems as compromised and remove the malicious packages. Best practices include pinning dependencies, monitoring for anomalies, and using automated supply chain security tools. Security teams need to move towards context-aware, behavior-driven analysis to stay ahead of these threats.