Malicious versions are 2.6.2 and 2.6.3: https://socket.dev/blog/lightning-pypi-package-compromised