Is It Dead Yet? dependency vitals

lightningPyPI

Signals · last 1 check

Commits 90d
32
Open issues
850
Unanswered
192
Contributors
24
State history 1
WhenChange
2026-09-03 first verdict: active
Supply-chain history 1

  1. account hijacked 2026-04 2.6.2, 2.6.3

    A long-lived PyPI token in CI secrets was used to upload wheels directly, bypassing the release workflow, with a hidden runtime directory that downloaded and ran a credential-stealing worm on import.

    PyPI quarantined the project; 2.6.1 is the last clean release.

    Source: Snyk analysis, 30 April 2026. History, not a warning about today — the verdict above is about maintenance now.

Badge

maintenance: active

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/pypi/lightning.svg)](https://isitdeadyet.dev/pypi/lightning)

Watch it

Get told when lightning changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.