Microsoft DurableTask Python Client Targeted in TeamPCP Cyberattack

Gbhackers •Divya • May 20, 2026

The ongoing TeamPCP software supply chain campaign has compromised the official Microsoft DurableTask Python client, a widely used package for orchestrating workflows in Python applications. Three versions of the durabletask package on PyPI, 1.4.1, 1.4.2, and 1.4.3, were identified as malicious and subsequently quarantined by PyPI after analysis by Wiz researchers. This incident highlights how attackers are […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TeamPCP Compromises Microsoft DurableTask and GitHub Actions in Supply Chain Attack The TeamPCP threat group has expanded its supply chain attack campaign, compromising the Microsoft DurableTask Python client with versions v1.4.1, v1.4.2, and v1.4.3 found to contain a credential-stealing worm. This follows a prior attack on Aqua Security's Trivy vulnerability scanner, where malicious payloads were injected into CI/CD pipelines. The same credential-stealing method was observed in Checkmarx's GitHub Action shortly after the Trivy incident. The attacks involved the use of typosquatting techniques to redirect exfiltrated data to deceptive domains. Security researchers from Wiz confirmed the malicious nature of the DurableTask packages, leading to their quarantine on PyPI. Organizations using these tools are advised to rotate credentials and audit their CI/CD environments for potential exposure. The ongoing nature of these attacks highlights the vulnerabilities in software supply chains and the need for heightened security measures. 9 sources 74

Extracted Entities

Microsoft DurableTask Python Client Targeted in TeamPCP Cyberattack

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)