TeamPCP conducted a supply chain attack by compromising Microsoft's Python Durable Task client package on PyPI. Using stolen CI/CD credentials, they published malicious versions 1.4.1 through 1.4.3 that included credential-stealing malware. This campaign has targeted multiple packages, leveraging trusted developer tools to propagate malware and harvest credentials. The attack chain involves backdooring packages, stealing CI/CD secrets, and pushing further malicious versions downstream. The compromise was publicly disclosed on May 27, 2026, with detailed analysis available from multiple security research sources.

Malicious versions of the durabletask package could lead to credential theft and further propagation of malware within affected environments. This compromises the security of development and deployment pipelines relying on this package. The attack undermines trust in the supply chain and may expose sensitive credentials and cloud environments to unauthorized access. No known exploits in the wild have been reported yet, but the potential for widespread impact exists given the package's usage in development workflows.

Patch status is not yet confirmed — check the vendor advisory and trusted security research sources for current remediation guidance. Until an official fix or updated clean package versions are released, avoid using the compromised durabletask versions 1.4.1, 1.4.2, and 1.4.3. Review and rotate any potentially exposed credentials and CI/CD secrets. Monitor official Microsoft and PyPI advisories for updates on remediation and safe package versions.