A malicious version of the PyTorch Lightning package published on the Python Package Index (PyPI) delivers a ...
Claude Opus commit added malicious npm dependency in Feb 2026, enabling crypto theft and persistent RAT access.