# durabletask: TeamPCP's Latest PyPi Compromise

TeamPCP used a compromised GitHub account to steal a PyPI token and publish malicious durabletask 1.4.1-1.4.3, whose rope.pyz payload steals cloud credentials and worms via AWS SSM and Kubernetes.

- Payout: Real-world hack
- Severity: critical
- Program: durabletask
- Analysis by: Wiz Research
- Disclosed: 2026-05-19
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/durabletask-teampcp-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-durabletask-teampcp-supply-chain-attack
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:aws tech:github-actions tech:kubernetes tech:python technique:chained vuln:secrets-leak

**Target:** PyPI package / GitHub Actions secrets
**Root cause:** Attacker compromised a GitHub user account (linked to the earlier @antv wave), dumped GitHub secrets from microsoft/durabletask-python including the PyPI publish token, and used it to publish trojanized releases.
**Steps:**
1. Compromise GitHub account with access to microsoft/durabletask-python
2. Dump repository GitHub secrets to obtain the PyPI token
3. Publish durabletask v1.4.1/1.4.2/1.4.3 with injected `__init__.py`/`task.py`/`entities/__init__.py`, `extensions/__init__.py`, `payload/__init__.py` code
4. On install, payload downloads `rope.pyz` from `https://check.git-service[.]com/rope.pyz` (backup `t.m-kosche[.]com`) to `/tmp/managed.pyz` or `/tmp/rope-*.pyz`
5. Payload harvests AWS/Azure/GCP/K8s/Vault creds, shell history, and brute-forces Bitwarden/1Password/GPG
6. Worm propagates via AWS SSM SendCommand and kubectl exec to up to 5 targets per host, writing marker `~/.cache/.sys-update-check`
**How found:** Wiz linked the compromised GitHub account to the prior @antv wave by its publication history, then observed the same account targeting microsoft/durabletask-python between 15:08-15:16 UTC, copying the latest commit message and dumping secrets consistent with prior credential-dump behavior.
**Exploitation:** Stolen PyPI token publishes malicious wheels; on import the injected module fetches and runs rope.pyz, which exfiltrates credentials to /api/public/version, propagates laterally via SSM and Kubernetes, and includes a killswitch (/v1/models) and a wiper (/audio.mp3) targeting Israel/Iran.
**Escalation:** Credential theft chained into cloud/K8s lateral movement with a 5-target-per-host propagation limit and password-manager brute force to widen access.
**Insight:** Correlate package-publish anomalies with the publishing account's prior repo activity: a single compromised GitHub identity can be traced across waves, and PyPI tokens living in GitHub Actions secrets are the pivot point to watch.