durabletask: TeamPCP's Latest PyPi Compromise

The supply chain campaign linked to TeamPCP continues with the compromise of durabletask v1.4.1, v1.4.2, and v1.4.3. DurableTask is the official Microsoft Python client for the Durable Task workflow execution framework.

These packages have been quarantined by PyPi, subsequent to Wiz's analysis.

Root Cause

There is a direct link between the previously reported @antv wave and this compromised package.

A compromised user account was identified based on their publication of the repositories implicated in that wave. That same account can be observed targeting the microsoft/durabletask-python between 15:08 UTC and 15:16 UTC:

We can observe the attacker copied the latest commit message from main, and the behavior matches past examples of leveraging compromised credentials to dump secrets from GitHub. Workflows in the repository indicate that the PyPi token was present within the GitHub secrets.

So we can conclude that the attacker compromised a GitHub account via a previous attack, dumped GitHub secrets from a repository to which the user had access, and from there had access to the PyPi token to publish directly.

Payload

The payload is a slight evolution of the one previously deployed in the compromise of the guardrails-ai package on May 11th.

What steps should security teams take?

Wiz customers should refer to the Wiz Threat Intelligence Center Advisory on this incident.

1. Immediately identify exposure: Search lockfiles and CI logs for durabletask versions 1.4.1, 1.4.2, or 1.4.3. Look for /tmp/managed.pyz or /tmp/rope-*.pyz on Linux systems.

2. Check for persistence: Search for the infection marker ~/.cache/.sys-update-check (AWS/general) and ~/.cache/.sys-update-check-k8s (Kubernetes) on affected systems. Presence confirms payload execution. Check for running python3 /tmp/managed.pyz processes.

3. Rotate all credentials: If exposure is suspected, rotate AWS credentials (especially IAM User credentials), Azure credentials, GCP service accounts, Kubernetes service accounts, Vault tokens, and any passwords stored in Bitwarden, 1Password, or pass/gopass. Assume shell history (.bash_history, .zsh_history) was exfiltrated.

4. Audit AWS SSM and Kubernetes: Check CloudTrail for SSM:SendCommand and SSM:DescribeInstanceInformation calls from compromised instances. Review Kubernetes audit logs for unexpected kubectl exec activity. The worm propagates to up to 5 targets per infected host.

5. Check password manager sessions: Review Bitwarden (bw) and 1Password (op) CLI usage. The payload attempts brute-force unlock using harvested passwords from environment variables and shell history.

6. Block C2 infrastructure: Block check.git-service.com and t.m-kosche.com at the DNS/proxy level. Block outbound connections to the exfil endpoints /v1/models, /audio.mp3, and /api/public/version.

For longer term hardening guidance, Wiz has developed:

• How to Harden GitHub Actions: An Updated Guide

• Practical Package Security: The Unofficial Guide
  

Indicators of compromise

Network Indicators

Runtime Indicators