durabletask (Microsoft's Python Durable Task client) compromised by TeamPCP
Source Reddit BlueTeam
Discussion
The Python Durable Task client package 'durabletask' from Microsoft was compromised by the threat actor TeamPCP. Malicious versions 1.4.1, 1.4.2, and 1.4.3 were pushed to PyPI using stolen CI/CD credentials. These trojanized packages contained backdoors that harvested credentials at runtime and propagated further through stolen credentials. This compromise is part of a broader supply chain attack campaign by TeamPCP affecting multiple developer tools and SDKs since March 2026.
r/blueteamsec (opens in a new tab)u/Upstairs_Safe29220 points0 comments
We've been tracking TeamPCP since March. This is the fifth major package in the same campaign.
The pattern:
- Backdoor a trusted developer tool (scanner, SDK, package)
- Use stolen CI/CD credentials to push malicious versions to a registry
- Malicious version harvests credentials at runtime, propagates via the stolen creds
- Repeat
TeamPCP timeline since March:
- Mar 19 - Trivy compromised. CI/CD secrets harvested downstream.
- Mar 24 - LiteLLM 1.82.7/1.82.8 to PyPI via credentials stolen through Trivy. ~95M monthly downloads. ~1,000 cloud environments in a 3 hour window.
- Mar 27 - Telnyx Python SDK 4.87.1/4.87.2 to PyPI. WAV steganography for payload delivery. ~670K monthly downloads.
- April - Bitwarden CLI, SAP npm packages, PyTorch Lightning.
- May 11 - 84 malicious versions across ~170 packages. First SLSA Build Level 3 provenance bypass. OpenAI hit downstream.
- May 20 - durabletask 1.4.1/1.4.2/1.4.3.
Research:
- Aikido: https://www.aikido.dev/blog/durabletask-package-compromised-mini-shai-hulud
- StepSecurity IOCs: https://www.stepsecurity.io/blog/microsofts-durabletask-pypi-package-compromised-in-supply-chain-attack
- Endor Labs: https://www.endorlabs.com/learn/trojanized-microsoft-sdk-durabletask-1-4-1-through-1-4-3-deliver-credential-stealing-malware
We wrote on the LiteLLM chain attack when this started. Same TTPs, different package: https://www.bluerock.io/post/litellm-supply-chain-protection
Links cited in the discussion
- https://www.aikido.dev/blog/durabletask-package-compromised-mini-shai-hulud
- https://www.stepsecurity.io/blog/microsofts-durabletask-pypi-package-compromised-in-supply-chain-attack
- https://www.endorlabs.com/learn/trojanized-microsoft-sdk-durabletask-1-4-1-through-1-4-3-deliver-credential-stealing-malware
- https://www.bluerock.io/post/litellm-supply-chain-protection
References
- aikido.dev/blog/durabletask-package-compromised-mini-shai-hulud (opens in a new tab)
- reddit.com/r/blueteamsec/comments/1tpb2x4/durabletask_microsofts_python_durable_task_client/ (opens in a new tab)
- stepsecurity.io/blog/microsofts-durabletask-pypi-package-compromised-in-supply-chain-attack (opens in a new tab)
- endorlabs.com/learn/trojanized-microsoft-sdk-durabletask-1-4-1-through-1-4-3-deliver-credential-stealing-malware (opens in a new tab)
- bluerock.io/post/litellm-supply-chain-protection (opens in a new tab)