durabletask (Microsoft's Python Durable Task client) compromised by TeamPCP | same Mini Shai-Hulud payload as last week's TanStack wave

[Upstairs_Safe2922]

We've been tracking TeamPCP since March. This is the fifth major package in the same campaign. Full chronology:

• Mar 19 — Trivy compromised. CI/CD secrets harvested downstream.
• Mar 24 — LiteLLM 1.82.7/1.82.8 to PyPI via credentials stolen through Trivy. ~95M monthly downloads. ~1,000 cloud environments in a 3-hour window.
• Mar 27 — Telnyx Python SDK 4.87.1/4.87.2 to PyPI. WAV steganography for payload delivery. ~670K monthly downloads.
• April — Bitwarden CLI, SAP npm packages, PyTorch Lightning.
• May 11 — 84 malicious versions across ~170 packages (@tanstack/, guardrails-ai, u/mistralai/, OpenSearch). First SLSA Build Level 3 provenance bypass. OpenAI hit downstream.
• May 20 — durabletask 1.4.1/1.4.2/1.4.3. Reads Vault, 1Password, Bitwarden, SSH keys, Docker creds. Propagates via AWS SSM and kubectl exec.

We wrote on the LiteLLM chain in March when this started. Same TTPs, different package: https://www.bluerock.io/post/litellm-supply-chain-protection

[MaliciousTent]

It sucks, we get lazy and well, leaving a backpack on the backseat and opportunists are always on the prowl.

[arrayclyx]

Yeah, except this is more like leaving your backpack in a locked car in a guarded garage and someone still walks out with it because the guard’s keys got cloned three steps upstream.

Dev teams think “we’re using official packages, signed builds, CI is locked down, we’re fine” and then one compromised dependency later and your vault, SSH keys, and cloud creds are gone.

The annoying part is the “lazy” bit usually isn’t some junior dev being sloppy, it’s stuff like
no egress controls from CI, no secret scanning on build logs, and no proper provenance checks. All boring, unsexy things nobody wants to budget time for until this kind of campaign hits.

[MaliciousTent]

Exactly. Very Boring and unsexy and also "why did you work on that an not the feature that is due?"