Microsoft durabletask PyPI hit by Mini Shai-Hulud

Microsoft's official Python SDK for Azure Durable Functions, the PyPI package durabletask, briefly shipped with a credential stealer on May 19, 2026, after attackers used a stolen publishing token to push three back-to-back malicious releases directly to the package index, bypassing the project's GitHub-based release pipeline entirely.

durabletask sees roughly 400,000 PyPI downloads per month. Researchers at StepSecurity and Wiz, who jointly reconstructed the incident, said versions 1.4.1, 1.4.2, and 1.4.3 were published inside a 35-minute window before a public report and an Amazon Inspector advisory prompted Microsoft to yank them. None of the three had a matching tag, release, or CI/CD run in microsoft/durabletask-python. Wiz traced the publishing credential to a contributor GitHub account previously implicated in the @antv npm wave earlier that morning, and said the attackers copied the latest legitimate commit message to disguise the upload while pulling the PyPI token from GitHub repository secrets. Each release embedded the dropper a little deeper: 1.4.1 patched only __init__.py, 1.4.2 added a task.py, and 1.4.3 spread the loader across entities/, extensions/, and payload/. The 14-line dropper ran at import time on Linux and fetched a 28 KB second stage called rope.pyz from check.git-service.com, a domain registered through NameSilo three days earlier.

rope.pyz was an industrial-grade collector. StepSecurity catalogued more than 90 on-disk credential paths covering AWS, Azure, GCP, Kubernetes, HashiCorp Vault, GitHub, Docker, SSH, infrastructure-as-code state for Terraform, Ansible, and Pulumi, shell histories, AI-tooling configurations for Claude, Cursor, VS Code MCP, and Codeium, and the 1Password, Bitwarden, pass, and gopass command-line tools. Persistence wrote /tmp/managed.pyz, installed a systemd unit called pgsql-monitor.service to mimic a database agent, and marked infected hosts with a ~/.cache/.sys-update-check file. The propagation logic resembled TeamPCP's other 2026 waves: where the payload found AWS credentials it issued SSM SendCommand calls against up to five EC2 instances per profile, and where it found a kubeconfig it ran kubectl exec into up to five pods per cluster. Stolen material flowed out over three parallel channels, HTTPS POSTs to the C2, GitHub commit beacons under the FIRESCALE tag using victim tokens, and public repositories created on stolen GitHub accounts named for Russian folklore figures. The malware skipped Russian-locale systems and hosts with two or fewer CPU cores, and a roulette.py module inspected locale settings for Israeli and Iranian indicators and, on a one-in-six roll, played an audio file and ran rm -rf /*.

Amazon Inspector flagged the packages as MAL-2026-4174. A public report landed in microsoft/durabletask-python issue #137 at 17:54 UTC, and Microsoft yanked all three versions ten minutes later. Researchers tied the operation to TeamPCP's broader Mini Shai-Hulud activity through shared t.m-kosche.com infrastructure and the folklore-naming pattern, even though durabletask was a Python package rather than the @tanstack/setup Node module that drove the May 11 wave. The cross-ecosystem aggregate lives on [[shai-hulud-here-we-go-again]]; this record holds the durabletask-specific evidence.