durabletask: TeamPCP's Latest PyPi Compromise

Discover the latest on malicious versions of the pypi package durabletask, matching TeamPCP tactics.

The supply chain campaign linked to TeamPCP continues with the compromise ofdurabletaskv1.4.1,v1.4.2, andv1.4.3. DurableTask is the official Microsoft Python client for the Durable Task workflow execution framework.

These packages have been quarantined by PyPi, subsequent to Wiz's analysis.

There is a direct link between thepreviously reported@antvwaveand this compromised package.

A compromised user account was identified based on their publication of the repositories implicated in that wave. That same account can be observed targeting themicrosoft/durabletask-pythonbetween 15:08 UTC and 15:16 UTC:

We can observe the attacker copied the latest commit message from main, and the behavior matches past examples of leveraging compromised credentials to dump secrets from GitHub. Workflows in the repository indicate that the PyPi token was present within the GitHub secrets.

So we can conclude that the attacker compromised a GitHub account via a previous attack, dumped GitHub secrets from a repository to which the user had access, and from there had access to the PyPi token to publish directly.

The payload is aslight evolution of the one previously deployedin the compromise of theguardrails-aipackage on May 11th.

Wiz customers should refer to theWiz Threat Intelligence Center Advisoryon this incident.

Immediately identify exposure: Search lockfiles and CI logs for durabletask versions 1.4.1, 1.4.2, or 1.4.3. Look for/tmp/managed.pyzor/tmp/rope-*.pyzon Linux systems.

Check for persistence: Search for the infection marker~/.cache/.sys-update-check(AWS/general) and~/.cache/.sys-update-check-k8s(Kubernetes) on affected systems. Presence confirms payload execution. Check for running python3/tmp/managed.pyzprocesses.

Rotate all credentials: If exposure is suspected, rotate AWS credentials (especially IAM User credentials), Azure credentials, GCP service accounts, Kubernetes service accounts, Vault tokens, and any passwords stored in Bitwarden, 1Password, or pass/gopass. Assume shell history (.bash_history, .zsh_history) was exfiltrated.

Audit AWS SSM and Kubernetes: Check CloudTrail for SSM:SendCommand and SSM:DescribeInstanceInformation calls from compromised instances. Review Kubernetes audit logs for unexpected kubectl exec activity. The worm propagates to up to 5 targets per infected host.

Check password manager sessions: Review Bitwarden (bw) and 1Password (op) CLI usage. The payload attempts brute-force unlock using harvested passwords from environment variables and shell history.

Block C2 infrastructure: Blockcheck.git-service.comandt.m-kosche.comat the DNS/proxy level. Block outbound connections to the exfil endpoints/v1/models,/audio.mp3, and/api/public/version.

For longer term hardening guidance, Wiz has developed:

How to Harden GitHub Actions: An Updated Guide

Practical Package Security: The Unofficial Guide

Wiz Runtime Sensor support for Google Cloud Run Containers is now generally available, giving teams real-time threat detection and response for their serverless container workloads.

Multi-ecosystem supply chain compromise by TeamPCP targets GitHub, NPM, and VSCode to steal credentials and establish persistence.

Eliminate cryptographic blind spots and neutralize legacy debt with an integrated cryptographic asset inventory. Identify risks across code, cloud, and runtime, using the Wiz Security Graph to prioritize migration and protect against "Harvest Now, Decrypt Later" attacks.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings