On 2026-05-19, threat actor TeamPCP (the operator behind the Mini Shai-Hulud npm wave and the GitHub-internal breach via Nx Console v18.95.0) published three trojanized versions (1.4.1, 1.4.2, 1.4.3) of the official Microsoft-published `durabletask` Python SDK to PyPI. The package is Microsoft's Azure Durable Functions Python client with approximately 417,000 monthly downloads at the time of compromise. PyPI maintainers and Microsoft yanked the versions within approximately 35 minutes of the first publish, but during that window any `pip install durabletask` (including transitive resolutions in CI/CD pipelines, ephemeral runners, and developer workstations) would have pulled the malicious build. This is the first officially-Microsoft-published package surface trojanized in the TeamPCP campaign.

## Initial Access & Trigger

Unlike typical supply-chain droppers that piggyback on `setup.py` / `pyproject.toml` install hooks, TeamPCP injected the dropper directly into the package's Python source files. This means execution occurs not at install time, but at **import time** — a single `import durabletask` (or any transitive import via Azure Functions Python tooling) is sufficient to execute the dropper. This bypasses install-time scanners that focus on package metadata and `setup.py` post-install hooks, and it ensures execution on any host that ever loaded the SDK during the compromise window, including hosts where the affected version was later upgraded out.

## Exploit Chain

1. **Initial Access (T1195.002 — Compromise Software Supply Chain).** Maintainer credentials for the official Microsoft `durabletask` PyPI project were used to publish v1.4.1, then v1.4.2, then v1.4.3 within ~35 minutes on 2026-05-19. The exact credential-theft vector against Microsoft's PyPI publishing identity has not been disclosed in public reporting, but the broader TeamPCP campaign has consistently abused OIDC tokens and harvested CI/CD secrets (cf. CVE-2026-45321, the TanStack OIDC abuse chain that fed the Nx Console publish). 2. **Execution (T1059.006 — Python).** The Python source files of the package are mutated to include a small bootstrapping stub that runs on module import. Because Python evaluates top-level statements when a module is first loaded, no install-time hook is required. 3. **Defense Evasion (T1027 — Obfuscated Files or Information).** The dropper stub is obfuscated and minified to avoid casual review of the package's source on PyPI, and the second-stage payload is fetched dynamically — the package on PyPI does not itself carry the credential-stealer bytes. 4. **Credential Access (T1552 — Unsecured Credentials, T1555 — Credentials from Password Stores, T1528 — Steal Application Access Token).** The second stage enumerates AWS, Azure, GCP, HashiCorp Vault, 1Password, and Bitwarden credential stores and harvests environment-resident tokens, including GitHub PATs and npm granular access tokens. 5. **Discovery (T1057, T1082, T1018).** Cloud-provider metadata services are queried (IMDS/IMDSv2 on AWS, Azure IMDS, GCE metadata) to discover instance identity, role bindings, and reachable peers. 6. **Lateral Movement (T1021.007 — Cloud Services, T1609 — Container Administration Command).** When running inside an EC2 instance with an attached IAM role that permits SSM, the worm uses AWS Systems Manager (`ssm:SendCommand`, `ssm:StartSession`) to execute commands on peer EC2 instances. When running inside a Kubernetes pod with a service-account that permits `pods/exec`, the worm uses `kubectl exec` to execute commands inside other pods. Both pivots deliver and re-execute the same payload, producing a worm that propagates inside cloud accounts and clusters rather than across the public internet. 7. **Exfiltration (T1567 — Exfiltration Over Web Service, T1573 — Encrypted Channel).** Harvested credentials and secrets are encrypted (PBKDF2-derived key, AES) and exfiltrated to Session messenger infrastructure: `filev2.getsession.org` (file delivery) and `seed1.getsession.org` (seed/control). The Session-messenger dead-drop pattern is shared with the @antv npm wave and the broader Mini Shai-Hulud lineage. 8. **Impact (T1485 — Data Destruction, T1561 — Disk Wipe).** iTnews reporting characterizes the durabletask second stage as carrying a Linux disk wiper. Unlike the W20 @ctrl/tinycolor wave, which gated wipe behavior on a 1-in-6 locale-conditional roll, the durabletask wiper materially extends destructive capability and removes the locale gating documented in prior waves. Any host that imported the trojanized SDK and matched the wiper's targeting criteria is at risk of irreversible data loss.

## C2 Infrastructure

The exfiltration channel uses the open-source Session messenger network (`getsession.org`), a Signal-fork that runs over a decentralized onion-routed Service Node network. The campaign uses two named hosts:

- `filev2.getsession.org` — File-server dead-drop. Encrypted credential bundles are uploaded here. - `seed1.getsession.org` — Seed/coordination node. Used for bootstrap and configuration.

Session traffic is HTTPS-tunneled and difficult to distinguish from legitimate messaging traffic without explicit allow-listing. Egress-control environments that do not allow outbound to `*.getsession.org` will block exfiltration; environments that allow it (developer endpoints, dev/test cloud accounts, ephemeral CI runners) are exposed.

## Persistence on Developer Endpoints

Where the dropper detects a developer endpoint (presence of VS Code workspace files, presence of `.claude/` directories), the second-stage writes persistence into the AI coding agent surface — the same vector first documented in the TanStack May 11 wave:

- `~/.claude/settings.json` — Anthropic Claude Code agent settings; the worm injects a malicious agent task that re-fires on next agent launch. - `.vscode/tasks.json` — VS Code workspace task definitions; the worm injects a task that re-fires when the workspace is opened.

These persistence vectors survive credential rotation and survive package removal, because they live in the user's home directory and the project workspace rather than in the package itself.

## Attribution

Attribution to TeamPCP rests on toolchain reuse across the Mini Shai-Hulud lineage (PBKDF2 salt strings, encrypted-bundle format, Session dead-drop addresses, persistence vectors), the operator's `"Love - TeamPCP"` README signature in the leaked framework source, and the temporal/coordinated nature of the W21 escalation (the durabletask publish on 2026-05-19 coincided with the @antv npm wave and was 24 hours after the Nx Console v18.95.0 publish that breached GitHub-internal). Mandiant / Google Threat Intelligence Group has not (as of 2026-05-25) issued a named-actor product on UNC6780 covering this incident. Microsoft publicly entered the response coalition; CISA has not added CVE-2026-45321 (the TanStack OIDC abuse chain that bridges Nx Console to TeamPCP) to the Known Exploited Vulnerabilities catalog in either of the two W21 update tranches.

## Affected Surface

Any environment that executed `pip install durabletask` resolving to 1.4.1, 1.4.2, or 1.4.3 on 2026-05-19 — or whose lockfile pinned one of those versions — is exposed. This includes ephemeral CI runners that ran a single `pip install` step. The import-time trigger means hosts that resolved to one of those versions and then never imported the package are at lower risk, but Azure Functions Python runtimes import the SDK at function-app startup, so any Functions deployment that pulled an affected version is at maximum exposure.

## Detection Surface

Durable behavioral indicators (preferred over framework artifacts, which now also fire on copycat forks of the leaked Shai-Hulud source):

- Writes to `~/.claude/settings.json` and `.vscode/tasks.json` from non-interactive processes. - Outbound DNS or HTTPS to `*.getsession.org` from server, CI, or container workloads. - Python processes invoking `aws ssm send-command` or `kubectl exec` against peer instances within the same cloud account or cluster. - IMDSv2 / Azure IMDS / GCE metadata enumeration from a Python process that just installed or imported `durabletask`. - 2FA-bypassing token-harvest patterns (large-scale enumeration of `~/.aws/credentials`, `~/.azure`, `~/.config/gcloud`, Vault token files, 1Password / Bitwarden CLI session tokens within a short time window from a single process).