durabletask PyPI Supply Chain Compromise (v1.4.1–1.4.3) — Microsoft-Published Azure Durable Functions SDK Trojanized w/ Cross-Cloud Credential Stealer + Linux Disk Wiper (TeamPCP / Mini Shai-Hulud) — Threadlinqs Intelligence
As of 2026-05-30, durabletask PyPI Supply Chain Compromise (v1.4.1–1.4.3) — Microsoft-Published Azure Durable Functions SDK Trojanized w/ Cross-Cloud Credential Stealer + Linux Disk Wiper (TeamPCP / Mini Shai-Hulud) is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0580 · Severity: CRITICAL · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
TeamPCP trojanized the officially Microsoft-published `durabletask` Python SDK (Azure Durable Functions client, ~417K monthly downloads) on PyPI on 2026-05-19, publishing three malicious versions
On 2026-05-19, threat actor TeamPCP (the operator behind the Mini Shai-Hulud npm wave and the GitHub-internal breach via Nx Console v18.95.0) published three trojanized versions (1.4.1, 1.4.2, 1.4.3) of the official Microsoft-published `durabletask` Python SDK to PyPI. The package is Microsoft's Azure Durable Functions Python client with approximately 417,000 monthly downloads at the time of compromise. PyPI maintainers and Microsoft yanked the versions within approximately 35 minutes of the first publish, but during that window any `pip install durabletask` (including transitive resolutions in CI/CD pipelines, ephemeral runners, and developer workstations) would have pulled the malicious build. This is the first officially-Microsoft-published package surface trojanized in the TeamPCP campaign.
## Initial Access & Trigger
Unlike typical supply-chain droppers that piggyback on `setup.py` / `pyproject.toml` install hooks, TeamPCP injected the dropper directly into the package's Python source files. This means execution occurs not at install time, but at **import time** — a single `import durabletask` (or any transitive import via Azure Functions Python tooling) is sufficient to execute the dropper. This bypasses install-time scanners that focus on package metadata and `setup.py` post-install hooks, and it ensures execution on any host that ever loaded the SDK during the compromise window, including hosts where the affected version was later upgraded out.
## Exploit Chain
1. **Initial Access (T1195.002 — Compromise Software Supply Chain).** Maintainer credentials for the official Microsoft `durabletask` PyPI project were used to publish v1.4.1, then v1.4.2, then v1.4.3 within ~35 minutes on 2026-05-19. The exact credential-theft vector against Microsoft's PyPI publishing identity has not been disclosed in public reporting, but the broader TeamPCP campaign has consistently abused OIDC tokens and harvested CI/CD secrets (cf. CVE-2026-45321, the TanStack OIDC abuse chain that fed the Nx Console publish).
2. **Execution (T1059.006 — Python).** The Python source files of the package are mutated to include a small bootstrapping stub that runs on module import. Because Python evaluates top-level statements when a module is first loaded, no install-time hook is required.
3. **Defense Evasion (T1027 — Obfuscated Files or Information).** The dropper stub is obfuscated and minified to avoid casual review of the package's source on PyPI, and the second-stage payload is fetched dynamically — the package on PyPI does not itself carry the credential-stealer bytes.
4. **Credential Access (T1552 — Unsecured Credentials, T1555 — Credentials from Password Stores, T1528 — Steal Application Access Token).** The second stage enumerates AWS, Azure, GCP, HashiCorp Vault, 1Password, and Bitwarden credential stores and harvests environment-resident tokens, including GitHub PATs and npm granular access tokens.
5. **Discovery (T1057, T1082, T1018).** Cloud-provider metadata services are queried (IMDS/IMDSv2 on AWS, Azure IMDS, GCE metadata) to discover instance identity, role bindings, and reachable peers.
6. **Lateral Movement (T1021.007 — Cloud Services, T1609 — Container Administration Command).** When running inside an EC2 instance with an attached IAM role that permits SSM, the worm uses AWS Systems Manager (`ssm:SendCommand`, `ssm:StartSession`) to execute commands on peer EC2 instances. When running inside a Kubernetes pod with a service-account that permits `pods/exec`, the worm uses `kubectl exec` to execute commands inside other pods. Both pivots deliver and re-execute the same payload, producing a worm that propagates inside cloud accounts and clusters rather than across the public internet.
7. **Exfiltration (T1567 — Exfiltration Over Web Service, T1573 — Encrypted Channel).** Harvested credentials and secrets are encrypted (PBKDF2-derived key, AES) and exfiltrated to Session messenger infrastructure: `filev2.getsession.org` (file delivery)
Weaknesses (CWE)
CWE-1357, CWE-506, CWE-829, CWE-494, CWE-913
Target sectors: technology, cloud, financial, healthcare, government, manufacturing, telecommunications, media, education, saas
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, CVE-2026-45321, T1195, T1195.002, T1078.004, T1059.006, T1204.002, T1546, T1574, T1027, T1036.005, T1070.004