PyTorch Lightning Supply Chain Attack Spreads Across PyPI and npm Ecosystems

PyTorch Lightning, a critical deep learning framework used across AI development, was compromised in versions 2.6.2 and 2.6.3 through a supply chain attack that automatically executes malware on installation. The attack steals developer credentials and cloud secrets while leveraging npm publish permissions to propagate across the JavaScript ecosystem—a sophisticated cross-ecosystem threat that endangers developers across multiple platforms.