Inferred

Inferred

Malware Compromises PyTorch Lightning Packages on PyPI

4 min · 5 de may de 2026
portada del episodio Malware Compromises PyTorch Lightning Packages on PyPI

Descripción

Lightning-AI disclosed that PyTorch Lightning versions 2.6.2 and 2.6.3 on PyPI shipped with credential-harvesting malicious code. The GitHub source repository was untouched — exposing a gap where the published PyPI artifact diverged from clean source code. In this episode: * The 42-minute window between release and PyPI quarantine, and what Lightning-AI's incident post and security advisory disclosed * How the credential-harvesting payload spawned on import and abused the GitHub GraphQL API to inject backdoors into victim repositories * Why a legitimate, trusted release — drawing 7.8M monthly downloads — defeats the name-based defenses developers rely on for typosquatted packages * How Aikido Security, Sonatype, and Semgrep's divergent payload measurements fragment the indicators of compromise defenders distribute across tooling * What Semgrep links to a tracked multi-package campaign, and why TeamPCP's LAPSUS$ affiliation claim remains unverified Topics: supply-chain security, PyPI, malware, credential harvesting, incident response, Lightning-AI Get Inferred in your inbox: https://inferredresearch.com [https://inferredresearch.com]

Comentarios

0

Sé la primera persona en comentar

¡Regístrate ahora y forma parte de la comunidad de Inferred!

Prueba gratis

Empieza 7 días de prueba

$99 / mes después de la prueba. · Cancela cuando quieras.

  • Podcasts solo en Podimo
  • 20 horas de audiolibros al mes
  • Podcast gratuitos

Todos los episodios

29 episodios

episode Malware Compromises PyTorch Lightning Packages on PyPI artwork

Malware Compromises PyTorch Lightning Packages on PyPI

Lightning-AI disclosed that PyTorch Lightning versions 2.6.2 and 2.6.3 on PyPI shipped with credential-harvesting malicious code. The GitHub source repository was untouched — exposing a gap where the published PyPI artifact diverged from clean source code. In this episode: * The 42-minute window between release and PyPI quarantine, and what Lightning-AI's incident post and security advisory disclosed * How the credential-harvesting payload spawned on import and abused the GitHub GraphQL API to inject backdoors into victim repositories * Why a legitimate, trusted release — drawing 7.8M monthly downloads — defeats the name-based defenses developers rely on for typosquatted packages * How Aikido Security, Sonatype, and Semgrep's divergent payload measurements fragment the indicators of compromise defenders distribute across tooling * What Semgrep links to a tracked multi-package campaign, and why TeamPCP's LAPSUS$ affiliation claim remains unverified Topics: supply-chain security, PyPI, malware, credential harvesting, incident response, Lightning-AI Get Inferred in your inbox: https://inferredresearch.com [https://inferredresearch.com]

5 de may de 20264 min
episode Amazon’s Custom Chips Hit $50B Annual Run Rate artwork

Amazon’s Custom Chips Hit $50B Annual Run Rate

Amazon CEO Andy Jassy described the company's custom chip division as running at a roughly $50 billion annual run rate when valued as a standalone merchant chip business — ranking it among the top three datacenter chip operations globally. The same disclosure put actual monetized chip revenue above $20 billion, growing at triple-digit rates year over year. In this episode: * The two figures Amazon disclosed for custom silicon — $50B imputed run rate and $20B+ realized revenue — and what each measures * Anthropic's $100B AWS commitment, Amazon's $13B equity stake, and how chip demand cycles between affiliated balance sheets * Trainium2 sold out, Trainium3 nearly fully subscribed, and Trainium4 capacity already pre-reserved 18 months before broad availability * AWS's $15B+ AI run-rate revenue and free-cash-flow pressure as 2026 capex heads toward $200B * Trainium4's NVLink Fusion support — engineering the chip to coexist with Nvidia's CUDA-tied workflows Topics: Amazon, Trainium, AWS, custom silicon, AI infrastructure, Anthropic, Nvidia Get Inferred in your inbox: https://inferredresearch.com [https://inferredresearch.com]

4 de may de 20263 min
episode Big Tech 2026 Capex Approaches $725B, Up 77% artwork

Big Tech 2026 Capex Approaches $725B, Up 77%

Microsoft, Alphabet, Amazon, and Meta have committed roughly $695-725 billion in 2026 capex, up 77% from 2025, driven by cloud demand and chip-cost pressures. In this episode: * How Microsoft, Amazon, Alphabet, and Meta justified their 2026 capex expansion in recent earnings * The role of component cost pressures in the overall capex figure * What Alphabet's improvement in inference serving costs indicates for future spending * Capex acceleration's relationship to revenue growth across the hyperscalers * Backlog conversion and cloud growth trajectory as tests of capacity demand Topics: Hyperscaler Capex, Cloud Infrastructure, AI Spending, Data Centers, Tech Capital Get Inferred in your inbox https://inferredresearch.com [https://inferredresearch.com]

4 de may de 202652 min
episode Meta Lifts 2026 Capex to $125-145B After Q1 Beat artwork

Meta Lifts 2026 Capex to $125-145B After Q1 Beat

Meta raised 2026 capex guidance by roughly $10 billion to $125-145 billion after beating Q1 estimates, signaling aggressive AI infrastructure investment while investors assess the path to revenue translation. In this episode: * Meta's Q1 earnings beat and the company's rationale for the capex guidance increase * How Meta structured expense guidance while nearly doubling AI infrastructure spending * Meta Superintelligence Labs and the timeline for AI product monetization * Component cost pressures and their contribution to the capex revision * May's workforce reduction and July's earnings report as tests of infrastructure ROI Topics: Meta, AI infrastructure, capex, earnings, monetization Get Inferred in your inbox https://inferredresearch.com [https://inferredresearch.com]

1 de may de 20262 min