Shai-Hulud Malware Found in PyTorch Lightning: Supply Chain Attack Breakdown

A Dune-themed backdoor hid in PyTorch Lightning for 11 days. Shai-Hulud exfiltrated model weights via DNS tunneling. No pip audit caught it. If your ML pipeline pulls from PyPI without hash pinning,