Loading story…
Attackers used compromised publishing credentials to push malicious versions 1.4.1, 1.4.2, and 1.4.3 of Microsoft’s official durabletask Python SDK to PyPI, turning a trusted Azure Durable Functions package into a supply-chain malware delivery mechanism. The tampered package inserted a dropper into core files including __init__.py; on Linux systems, importing the library triggered a download-and-execute chain from attacker-controlled infrastructure. Researchers said the last known safe release was 1.4.0, and observed outbound traffic tied to the campaign, including a command-and-control check to check[.]git-service[.]com.
The second-stage payload, identified as rope.pyz, was described as a modular intrusion framework aimed at Linux cloud workloads, Kubernetes clusters, CI/CD runners, and developer environments. Its capabilities included theft of AWS, Azure, GCP, Kubernetes, Vault, GitHub, and password-manager secrets, along with encrypted exfiltration, persistence, lateral movement, and resilient command-and-control using primary domains, GitHub dead drops, and fallback exfiltration through victim GitHub accounts. Analysts also reported multiple evasion features—such as Linux-only execution, Russian locale exclusion, CPU-based sandbox checks, detached subprocess execution, and encrypted communications—and said the malware contained probabilistic destructive logic that could wipe systems when Israeli or Iranian indicators were detected.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-20, GitHub confirmed a breach involving a poisoned VS Code extension on an employee device and said approximately 3,800 internal repositories were exfiltrated. GitHub stated the incident was limited to internal repositories based on its current assessment and that critical secrets had been rotated, while reporting linked the intrusion to the same infrastructure used in the durabletask supply-chain attack.
After the compromise was identified, PyPI quarantined durabletask versions 1.4.1 through 1.4.3 to limit further installation of the trojanized package. The affected releases had been uploaded using a stolen publishing token tied to the official project.
A May 19, 2026 analysis of WindowsTelemetry.zip and WindowsTelemetry.rar documented a PoisonX infection chain using DLL sideloading, persistence, a vulnerable driver for BYOVD, and a RAT communicating over raw TCP to 101.32.190[.]202:8080. The researchers also published public detection content, including a YARA cluster rule for multiple components.
During investigation of the durabletask incident, StepSecurity reported a monitored GitHub Actions workflow making a network call to check[.]git-service[.]com, consistent with the package's command-and-control behavior. This provided an observed indicator tied to the malicious package activity.
On May 19, 2026, StepSecurity and Upwind publicly reported that Microsoft's durabletask PyPI package had been compromised in a supply-chain attack. Their disclosures described credential theft targeting cloud, Kubernetes, CI/CD, and developer environments, along with evasion and persistence features.
On May 19, 2026, attackers used compromised publishing credentials to upload malicious durabletask versions 1.4.1, 1.4.2, and 1.4.3 to PyPI. The trojanized official package added a Linux-focused dropper that fetched and executed a remote payload when imported.
Before the malicious PyPI release, attackers finalized the remote payload later identified as rope.pyz and prepared supporting infrastructure, including command-and-control and delivery mechanisms. Reporting indicates this setup was in place in advance of the package upload.
The last known safe release of Microsoft's durabletask Python SDK, version 1.4.0, was published to PyPI before the compromise. Later reporting identified this version as the baseline users should pin to or earlier.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
22 references tracked. Mallory keeps watching after this page renders.
safedep.io
Open sourceitnews.com.au
Open sourcesafedep.io
Open sourcesafedep.io
Open sourceapp.stepsecurity.io
Open sourceendorlabs.com
Open sourcegithub.com
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Threat Intelligence warned that version `2.4.6` of the widely used `mistralai` package on PyPI was compromised in a software supply-chain attack, with malicious code inserted into `mistralai/client/__init__.py`. The code executed on import, retrieved a second-stage payload from a remote server, and deployed malware on Linux systems. The payload was written to `/tmp/transformers.pyz` to resemble legitimate Hugging Face tooling, while additional components including `pgmonitor.py` and a persistent `systemd` service named `pgsql-monitor.service` were used to blend into developer and database-monitoring environments. Microsoft said the malware primarily targeted credentials and persistence, with the potential to expose GitHub tokens, cloud API keys, SSH keys, npm credentials, and CI/CD secrets. Researchers said the intrusion may be tied to the broader **Mini Shai-Hulud** campaign, which has also been associated with compromised TanStack packages and multiple Mistral npm SDK packages, suggesting an expanding effort against developer ecosystems and trusted package repositories. The malware also contained geo-aware logic, including a destructive branch that could trigger system wiping on hosts appearing to be in Israel or Iran, while avoiding Russian-language systems. Microsoft urged defenders to isolate affected Linux hosts, block outbound connections to the malicious infrastructure, hunt for indicators including `/tmp/transformers.pyz`, `pgmonitor.py`, and `pgsql-monitor.service`, and rotate any credentials that may have been exposed.
Jun 29, 2026
Malicious versions `1.82.7` and `1.82.8` of the widely used `litellm` Python package were uploaded to PyPI after attackers used compromised publishing access, turning a popular AI gateway library into a supply-chain malware delivery vehicle. Researchers and project maintainers said the tainted code was absent from the upstream GitHub repository, indicating the compromise occurred in the release pipeline or during package publication. The malware executed on import in `1.82.7`, while `1.82.8` added a `litellm_init.pth` file that triggered on every Python interpreter startup, greatly expanding exposure even beyond direct use of the package. PyPI removed or quarantined the malicious releases, and `1.82.6` was identified as the last known clean version. The payload harvested a broad range of secrets, including cloud credentials, SSH keys, API tokens, Kubernetes service-account tokens, database and CI/CD secrets, `.env` files, shell histories, TLS keys, and cryptocurrency wallet data, then encrypted and exfiltrated the data to attacker-controlled infrastructure including `models.litellm.cloud`. Multiple reports said the malware also attempted Kubernetes lateral movement by enumerating clusters, dumping secrets, and deploying privileged pods across nodes, while establishing Linux persistence through a disguised `systemd` user service that contacted `checkmarx.zone` for follow-on payloads. Researchers linked the intrusion with high confidence to **TeamPCP**, tying it to the earlier Trivy compromise and a broader campaign spanning GitHub Actions, Docker Hub, npm, OpenVSX, and PyPI; organizations that installed and ran the affected versions were urged to assume full credential compromise, rotate secrets, inspect for persistence, and review Kubernetes environments for rogue activity.
Jul 29, 2026
Security researchers reported a supply-chain campaign targeting developers by impersonating legitimate AI-related tooling and luring victims into installing malware. A malicious PyPI package, `grokwrapper`, posed as an unofficial API wrapper for xAI’s Grok and used a common “benign-first, malicious-later” publishing pattern: an initial clean release was followed by a weaponized update intended to evade registry and scanner scrutiny. Once installed, the package was described as downloading and executing a second-stage payload, establishing persistence via Windows Registry changes, and maintaining access using **DLL sideloading** with a legitimate Microsoft binary (`wkspbroker.exe`), with targeting described as focused on developers outside CIS countries and consistent with tradecraft associated with **DPRK-linked** activity (including references to *Operation DreamJob* expansion beyond prior sectors). Separately, a maintainer documented abuse of a forked GitHub repository to distribute malware by converting the project’s README into a fake Windows “installer” landing page and embedding a ZIP payload directly in the source tree (rather than using GitHub Releases or a package manager). The attacker then rewired “Download” links to the embedded archive, mirrored the content via GitHub Pages, and reused the original project’s topics/metadata to drive **SEO hijacking**, increasing the chance that searches for enterprise AI integration terms would land on the malicious fork while the original author’s name appeared as a contributor due to inherited commit history. Together, the incidents highlight active abuse of trusted developer ecosystems (*PyPI* and *GitHub*) to deliver Windows malware through social engineering and dependency/asset trust assumptions.
Jul 12, 2026