---
id: 6830
title: "durabletask: TeamPCP's Latest PyPi Compromise"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/durabletask-teampcp-supply-chain-attack"
published_at: "2026-05-19T17:30:20Z"
tags: ["cloud", "supply-chain", "malware", "credential-theft", "pypi", "teampcp", "durabletask"]
phying_url: "https://phying.com/item/6830"
lang: en
---

# durabletask: TeamPCP's Latest PyPi Compromise

## Summary

TeamPCP hit durabletask 1.4.1-1.4.3, Microsoft's Durable Task client: a hijacked account dumped a GitHub-stored PyPI token to push malware that steals credentials, spreading via AWS SSM.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-05-19T17:30:20Z
- **Original:** https://www.wiz.io/blog/durabletask-teampcp-supply-chain-attack
- **Phying News:** https://phying.com/item/6830