{
	"id": "1d3299d6-9f95-4eae-a491-2dff8acfaf08",
	"created_at": "2026-08-06T02:03:09.466377Z",
	"updated_at": "2026-10-20T09:06:36.509473Z",
	"deleted_at": null,
	"sha1_hash": "501002a97254d8054e52af345fcb1e803a5c2519",
	"title": "TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1708216,
	"plain_text": "https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nTeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension,\n\ndurabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated\n\nBy Marcus Webb\n\nPublished: 2026-05-20 · Archived: 2026-08-06 02:01:48 UTC\n\nContents\n\nExecutive Summary\n\nOn May 19–20, 2026, two events landed within hours of each other. Wiz and Endor Labs documented three malicious\n\nversions of durabletask (1.4.1, 1.4.2, and 1.4.3) pushed to PyPI within a 35-minute window on May 19, the official\n\nMicrosoft Azure Python SDK for the Durable Task workflow framework. The same day, GitHub confirmed that a poisoned\n\nVS Code extension on an employee device had led to the exfiltration of approximately 3,800 internal repositories. TeamPCP\n\nlisted the source code for sale at $50,000: ‘it looks like our retirement is soon.’\n\n“Github knew for hours, they delayed telling you and they wont be honest in the future. what an amazing run, its been an\n\nhonor to play around with the cats over the past few months.”\n\n— @xploitrsturtle2 (box turtle / shai-huturtle, linked to TeamPCP), 3:40 AM · May 20, 2026 · 85.4K views\n\nBoth compromises trace to the same Mini Shai-Hulud worm infrastructure. durabletask drops rope.pyz from check.git-\n\nservice[.]com, uses the FIRESCALE GitHub dead-drop for C2 rotation, and creates exfiltration repositories with Russian\n\nPage 1 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nfolklore names. All three behaviors were documented in prior TeamPCP waves going back to March 2026. Hunt.io’s\n\ninfrastructure analysis puts C2 IP addresses from the 83.142.209.0/24 subnet across the March Checkmarx and Telnyx\n\ncompromises and this wave. Same subnet, same operators.\n\nThe GitHub breach follows directly from the worm’s own mechanics. It steals GitHub tokens; those tokens get used to\n\ncreate exfiltration repos. A poisoned extension on a GitHub employee device is the same playbook: compromised developer\n\ntooling as the path to upstream infrastructure. Nine weeks in, TeamPCP has GitHub’s internal source code. Zero CVEs exist\n\nfor any package across this entire campaign. Your scanner has no record of any of it.\n\nPage 2 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nTL;DR for Engineering Teams\n\nWhat it is: Self-propagating supply chain worm (Mini Shai-Hulud) compromising PyPI/npm packages and developer\n\ntooling. Wave Four: durabletask 1.4.1–1.4.3 backdoored; GitHub employee device compromised via poisoned VS Code\n\nextension, ~3,800 internal repos exfiltrated. Zero CVEs produced.\n\nWhere it bites: Linux CI/CD runners, cloud VMs (AWS/Azure/GCP/Kubernetes), developer machines running affected\n\npackages, GitHub Actions workflows with publish tokens.\n\nWhy it matters: 417,000 monthly downloads of durabletask. Active exploitation confirmed. Self-replicating via AWS SSM\n\nand kubectl exec. FIRESCALE C2 rotation via signed GitHub commits makes domain blocking insufficient.\n\nPatch status: durabletask 1.4.1, 1.4.2, 1.4.3 yanked from PyPI. Pin to 1.4.0. No patch required — these versions must be\n\navoided entirely.\n\nImmediate action: Run: pip show durabletask — pin to 1.4.0. Check /tmp/managed.pyz on every Linux host. Rotate all\n\ncloud credentials, GitHub tokens, and CI/CD secrets on any host that imported an affected version. Block check.git-\n\nservice[.]com and t.m-kosche[.]com at egress. Audit VS Code extensions on developer and CI machines.\n\nPage 3 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nCheck malware at https://phxintel.security/malware.html\n\nCampaign Overview\n\nField Value\n\nThreat Actor TeamPCP (attributed with high confidence by Wiz, Aikido, StepSecurity, Hunt.io)\n\nCampaign Name Mini Shai-Hulud (Wave Four)\n\nSupply chain compromise — malicious package injection + developer tooling\nAttack Type\npoisoning\n\nPrimary CVEs None. Zero CVEs produced across all stages.\n\nCWE-494 (Download of Code Without Integrity Check), CWE-506 (Embedded\nCWE\nMalicious Code)\n\nCVSS Score 10.0 (Critical) — supply chain RCE with lateral movement and data exfiltration\n\nAffected durabletask 1.4.1, 1.4.2, 1.4.3 (PyPI); poisoned VS Code extension (unconfirmed\n\nPackages name); TanStack npm (prior wave)\n\nActive\nConfirmed — GitHub breach confirmed May 20, 2026\nExploitation\n\nC2 Infrastructure check.git-service[.]com, t.m-kosche[.]com, 83.142.209.0/24 subnet\n\nCampaign Start March 2026 (Trivy, Checkmarx KICS, Telnyx, LiteLLM)\n\nWave Four Date May 19–20, 2026\n\nCampaign Timeline and Wave Structure\n\nTeamPCP has run the same worm infrastructure since at least March 2026, hitting new ecosystems with each wave.\n\nDate Incident Ecosystem Key Impact\n\nMarch Trivy, Checkmarx KICS, PyPI, npm, CI/CD credential theft; zero CVEs\n\n2026 LiteLLM, Telnyx Docker Hub,\n\ncompromised\n\nPage 4 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nDate Incident\n\nMarch Malicious Axios library\n\n31, via GitHub Actions\n\n2026 workflow\n\nSAP-ecosystem npm\nApril\npackages (mbt, @cap-\n2026\njs/db-service, @cap-\n(early)\njs/sqlite, @cap-js/postgres)\n\nTanStack compromised —\n\nMay 11, 84 malicious versions\n\n2026 across 42 @tanstack/*\n\npackages\n\nMay Mistral AI, UiPath,\n\n14–15, Guardrails AI, OpenSearch\n\n2026 packages compromised\n\nMay 19, durabletask 1.4.1–1.4.3\n\n2026 published with dropper\n\nGitHub internal breach —\n\nMay 20, ~3,800 repos exfiltrated\n\n2026 via poisoned VS Code\n\nextension\n\nProtect yourself with the latest threat intelligence, get access to PHOENIX BLUE T\n\nGitHub Incident Response Timeline\n\nThe following is a reconstructed timeline of public statements from GitHub and the threat actor on May 20, 2026, ordered\n\nchronologically. Times are approximate where only relative timestamps (‘8h ago’, ‘3h ago’) were available at time of\n\ncapture.\n\nTime (May\nActor\n20, 2026)\n\n~12:43 AM TeamPCP [Co-\n\nUTC (est.) Owner]\n\n~3:40 AM @xploitrsturtle2\n\nUTC (TeamPCP-linked)\n\n~12:43 AM\n\n– ~5:04 AM @github\n\nUTC\n\n5:04 AM @github (thread\n\nUTC 1/5)\n\n5:04 AM @github (thread\n\nUTC +3h 2/5)\n\nEcosystem\n\nGitHub Actions,\n\nVS Code\n\nnpm\n\nnpm\n\nnpm\n\nnpm, PyPI\n\nPyPI\n\nGitHub platform\n\nEvent\n\nPosts GitHub source code for sale on Breached forum. Claims\n\n~4,000 private repos. Asking price $50,000. ‘As always this is not\n\na ransom… if no buyer is found, we will leak it free.’\n\n‘Github knew for hours, they delayed telling you and they wont\n\nbe honest in the future. what an amazing run, its been an honor to\n\nplay around with the cats over the past few months. #teamPCP\n\n#github’\n\nInitial statement: ‘W\n\nGitHub’s internal repositories.’\n\ncustomer data impact outside internal repos.\n\n‘Yesterday we detected and contained a compromise of an\n\nemployee device involving a poisoned VS Code extension. We\n\nremoved the malicious extension version, isolated the endpoint,\n\nand began incident response immediately.’\n\n‘Our current assessment is that the activity involved exfiltration\n\nof GitHub-internal repositories only. The attacker’s current\n\nPage 5 of 17\n\nKey Impact\n\nOpenAI macOS signing certificate\n\nexposure (attributed to UNC1069\n\nseparately)\n\nSAP developer environment\n\ncompromise; Mini Shai-Hulud worm\n\ndeployed\n\nTwo OpenAI employee devices\n\ncompromised; code-signing certs\n\nexfiltrated\n\nHundreds of packages across high-\n\nprofile AI namespaces\n\n417,000 monthly downloads targeted;\n\nAzure Durable Functions workloads\n\nGitHub source code listed for sale at\n\n$50,000. Operator @xploitrsturtle2\n\nposts: ‘what an amazing run, its been an\n\nhonor’ — suggesting campaign wind-\n\ndown\n\noday\n\ne are investigating unauthorized access to\n\nConfirms no evidence of\n\n(1.2M views)\n\nTime (May\n\n20, 2026)\n\n5:04 AM\n\nUTC +3h\n\n5:04 AM\n\nUTC +3h\n\n5:04 AM\n\nUTC +3h\n\nGitHub Official Statements — Primary Source\n\nGitHub’s initial statement (posted approximately 8 hours before the 8:43 AM screenshot capture):\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nActor\n\n@github (thread\n\n3/5)\n\n@github (thread\n\n4/5)\n\n@github (thread\n\n5/5)\n\nEvent\n\nclaims of ~3,800 repositories are directionally consistent with our\n\ninvestigation so far.’\n\n‘We moved quickly to reduce risk. Critical secrets were rotated\n\nyesterday and overnight with the highest-impact credentials\n\nprioritized first.’\n\n‘We continue to analyze logs, validate secret rotation, and\n\nmonitor for any follow-on activity. We will take additional action\n\nas the investigation warrants.’\n\n‘We will publish a fuller report once the investigation is\n\ncomplete.’\n\n“We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact\n\nto customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations,\n\nand repositories), we are closely monitoring our infrastructure for follow-on activity.”\n\n— @github, initial statement · 17K likes · 6.2K retweets · 7M views\n\n“If any impact is discovered, we will notify customers via established incident response and notification channels.”\n\n— @github, follow-up · 1.6K likes · 436K views\n\nGitHub’s detailed thread, published 5:04 AM May 20, 2026 (1.2M views):\n\n1/ “Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We\n\nremoved the malicious extension version, isolated the endpoint, and began incident response immediately.”\n\n2/ “Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s\n\ncurrent claims of ~3,800 repositories are directionally consistent with our investigation so far.”\n\n3/ “We moved quickly to reduce risk. Critical secrets were rotated yesterday and overnight with the highest-impact\n\ncredentials prioritized first.”\n\n4/ “We continue to analyze logs, validate secret rotation, and monitor for any follow-on activity. We will take additional\n\naction as the investigation warrants.”\n\n5/ “We will publish a fuller report once the investigation is complete.”\n\n— @github thread, 5:04 AM · May 20, 2026 · 1.2M views\n\nPage 6 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nThreat Actor Statement — TeamPCP Operator\n\nThe operator post on X from @xploitrsturtle2 (account associated with ‘box turtle / shai-huturtle’) was published at 3:40\n\nAM May 20, 2026, approximately 80 minutes before GitHub’s detailed thread. The phrasing ‘GitHub knew for hours’ and\n\nthe present tense suggest the actor had visibility into GitHub’s internal response before public disclosure. The statement ‘its\n\nbeen an honor to play around with the cats over the past few months’ is consistent with the retirement framing in the\n\nBreached forum post. Attribution of this account to TeamPCP is based on consistent campaign branding (#teamPCP, shai-\n\nhuturtle naming referencing Mini Shai-Hulud) and operational timing; this assessment carries medium-to-high confidence.\n\nPage 7 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nScope of Exposed Repositories\n\nThe file listing shared by TeamPCP as proof of breach contains repository archives across GitHub’s internal infrastructure.\n\nSelected repositories visible in the leaked listing include:\n\nRepository Name Inferred Function / Sensitivity\n\nGitHub’s Model Context Protocol server — high sensitivity\ngithub-mcp-server\ngiven MCP is developer tooling infrastructure\n\ngithub-mcp-server-remote\n\ngithub-models-extension\n\ngithub-Security-Risk-Reporting\n\ngithub-ui-xss-hardening-research\n\ngithub-oauth-proxy\n\ngithub-InternalDSFCuration\n\ngithub-internal-usage-requests\n\ngithub-ospo-internal\n\ngithub-sentry-reports\n\ngithub-synthetic-monitor\n\ngithub-telemetry-go / -py / -ruby\n\ngithub-load-balancers / github-load-\n\ntest\n\ngithub-satellite.com\n\ngithub-enterprise-server-release-\n\nnotifier\n\ngithub-well-architected / -internal\n\ngithub-gitignore-internal / github-\n\ngitignore-Eternal\n\ngithub-for-Startups-HQ / -Internal\n\nRemote MCP server component\n\nGitHub Models product extension code\n\nInternal security risk reporting tooling\n\nInternal XSS hardening research — knowledge of unfixed\n\nattack surface\n\nOAuth proxy infrastructure — credential flow code\n\nInternal developer success tooling\n\nInternal usage request tooling\n\nOpen Source Programs Office internal tooling\n\nError monitoring and telemetry reports\n\nSynthetic monitoring infrastructure\n\nMulti-language telemetry pipeline code\n\nLoad balancing infrastructure and test tooling\n\nGitHub Satellite conference infrastructure\n\nEnterprise Server release automation\n\nInternal architecture standards and tooling\n\nInternal gitignore tooling\n\nGitHub for Startups program infrastructure\n\nPage 8 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nRepository Name Inferred Function / Sensitivity\n\ngithub-githubfundingprivatebeta\n\ngithub-Subsidiary-Operations\n\ngithub-ppl-codex\n\ngithub-project-super-dashboard\n\nGitHub Sponsors / funding private beta code\n\nSubsidiary operations tooling\n\nPeople and codex internal tooling\n\nInternal project management dashboard\n\ngithub-sponsors\n\ngithubuniverse.com\n\ngithub-v4\n\nThe repository list includes github-mcp-server and github-mcp-server-remote. Given MCP is now a core integration layer\n\nGitHub Sponsors platform code\n\nGitHub Universe conference site code\n\nLikely GitHub GraphQL API v4 related code\n\nbetween AI coding agents and developer infrastructure, exposure of this code is particularly relevant for teams building on\n\nGitHub’s MCP surface.\n\nThe full claimed list runs to approximately 4,000 entries. GitHub’s own statement (‘~3,800 repositories are directionally\n\nconsistent with our investigation’) confirms the order of magnitude. The repositories above represent a selection of those\n\nwith the highest inferred sensitivity based on naming conventions visible in the leaked file listing. This is not an exhaustive\n\nlist, and the actual contents of each archive are unknown.\n\nTechnical Analysis\n\nRoot Cause: Credential Theft Enabling Package Publishing\n\nThe durabletask compromise follows the same access pattern documented by Wiz: credentials stolen in a prior attack\n\ncompromised a GitHub account, repository secrets were dumped, and a recovered PyPI publishing token was used to push\n\nmalicious versions directly. Three versions in 35 minutes: 1.4.1 at 16:19 UTC, 1.4.2 at 16:49, 1.4.3 at 16:54. Each release\n\nadded more injection points to cover more import paths.\n\nThe GitHub breach came through a different vector. GitHub confirmed a poisoned VS Code extension on an employee\n\ndevice. The Nx Console project had a concurrent compromise pushing a multi-stage credential stealer; GitHub hasn’t\n\npublicly confirmed the extension name, but timing and mechanism align. From there the malware harvested credentials with\n\naccess to GitHub’s internal repositories.\n\nAttack Chain: durabletask Wave\n\nThe durabletask attack runs in three stages:\n\nStage 1 — Import-time dropper: A 13-line block injected at the top level of __init__.py (and progressively more\n\nmodule files across versions 1.4.1–1.4.3) runs on any import durabletask call. The dropper is Linux-only, detaches\n\nvia start_new_session=True, swallows errors via except: pass, and downloads rope.pyz from check.git-service[.]com\n\nto /tmp/managed.pyz before launching it as a background process. No function call needed; cold start in Azure\n\nFunctions triggers it before any user code runs.\n\nStage 2 — Second-stage payload (rope.pyz): A Python zipapp with 19 modules. Pre-flight checks exit on non-\n\nLinux, Russian locale ($LANG starting with ru), or CPU count \u003c= 2 (sandbox evasion). The FIRESCALE dead-drop\n\nsearches GitHub commit API for ‘FIRESCALE’ patterns containing base64-encoded C2 URLs with RSA-SHA256\n\nsignatures, providing the attacker a censorship-resistant C2 rotation mechanism requiring only a public Git commit.\n\nStage 3 — Full credential harvest and worm propagation: Eight concurrent credential modules via\n\nThreadPoolExecutor target: AWS IAM/SSM/Secrets Manager (all 19 regions), Azure service principals/Key Vaults,\n\nGCP service account keys/Secret Manager, Kubernetes secrets across all contexts, HashiCorp Vault KV v1+v2,\n\n1Password, Bitwarden, pass/gopass. Additionally targets AI developer tooling configs: claude_desktop_config.json,\n\nCursor MCP config, VS Code MCP config, Codeium, Zed, Continue. Propagates to up to five AWS EC2 instances\n\nvia SSM SendCommand and up to five Kubernetes pods via kubectl exec.\n\nPage 9 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nCheck malware at https://phxintel.security/malware.html\n\nVersion Expansion Pattern\n\nEach version published by TeamPCP expanded the dropper’s injection coverage:\n\nVersion Infected Files\n\n1.4.1 durabletask/__init__.py\n\n1.4.2 __init__.py + task.py\n\n5 files: __init__.py, task.py, entities/__init__.py,\n1.4.3\nextensions/__init__.py, payload/__init__.py\n\nFIRESCALE Dead-Drop Mechanism\n\nWhen the primary C2 (check.git-service[.]com) is unreachable, rope.pyz queries the GitHub commit search API:\n\nGET https://api.github.com/search/commits?q=FIRESCALE\u0026sort=committer-date\u0026order=desc\u0026per_page=30\n\nEach result is inspected for the pattern:\n\nFIRESCALE \u003cbase64_url\u003e.\u003cbase64_signature\u003e\n\nThe base64 URL is only trusted if the RSA-SHA256 signature verifies against a hardcoded 4096-bit public key baked into\n\nthe binary. The upshot: the attacker rotates C2 by pushing a single signed commit anywhere on GitHub. T\n\ncheck.git-service[.]com doesn’t stop the worm. Only rotating the FIRESCALE signing key does.\n\nGitHub Breach — Infrastructure Linkage\n\nHunt.io tied the GitHub breach to the same TeamPCP infrastructure through overlapping C2 IP ranges. Three addresses in\n\nthe 83.142.209.0/24 subnet: 83.142.209.194 on the TanStack wave, 83.142.209.11 and .203 on the March 2026 Checkmarx\n\nand Telnyx attacks. Both .11 and .203 had SSH active from November 15–21, 2025, roughly four months before T\n\nwent public. Pre-staged infrastructure, not coincidence. The same subnet shows up across every T\n\ntracked through May 2026.\n\nTeamPCP provisions C2 servers months before activation to build clean reputation histories. IP reputation and domain age\n\nsignals give security teams false confidence on this group.\n\nExfiltration with GitHub Token Abuse\n\nPage 10 of 17\n\nImport Paths Covered\n\nimport durabletask\n\n+ from durabletask.task\n\nimport …\n\nAll major import paths\n\ncovered\n\naking down\n\nanStack\n\neamPCP wave Hunt.io\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nWhen both C2 channels fail, rope.pyz uses stolen GitHub tokens to create public repositories named after Russian folklore\n\n(BABA-YAGA, KOSCHEI, FIREBIRD, PTITSA, RUSALKA, MOROZKO, LESHY\n\nuploads the encrypted credential bundle as results.json. The victim’s own GitHub account becomes the exfil channel. From\n\nthe outside it looks like ordinary repository activity.\n\nDestructive Payload\n\nOn hosts fingerprinted as Israeli or Iranian (timezone, /etc/timezone, /etc/localtime, $LANG, $LC_ALL, $LC_MESSAGES\n\nchecks for he_IL or fa_IR), roulette.py rolls a 1-in-6 die. On a hit: downloads audio.mp3 from check.git-service[.]com, sets\n\nsystem volume to 100% via pactl, plays it through mpv, then runs rm -rf /*. The payload is operator-activated. The attacker\n\ntriggers it by returning HTTP 200 from /v1/models during the check-in call.\n\nCheck malware at https://phxintel.security/malware.html\n\nAffected Packages and V\n\nPackage\n\ndurabletask\n\nersions\n\nMalicious Clean\nEcosystem\nVersions Version\n\n1.4.1,\n\nPyPI 1.4.2, 1.4.0\n\n1.4.3\n\ndurabletask PyPI 1.4.2 1.4.0\n\ndurabletask PyPI 1.4.3 1.4.0\n\nrope.pyz\nC2 delivery Any N/A\n(payload)\n\n@tanstack/*\nnpm\n(42 packages)\n\nVS Code\nVS Code\nextension\nmarketplace\n(unconfirmed)\n\nExposure Analysis\n\n84\nLatest\nmalicious\nclean\nversions\n\nPoisoned Verified\n\nversion clean\n\nPage 11 of 17\n\n, DOMOVOI, VODYANOY) and\n\nSHA-256 (tar.gz)\n\n1.4.1:\n\n3de04fe2a76262743ed089efa7115f4508619838e77d60b9a1aab8b20d2cc8bf\n\n85f54c089d78ebfb101454ec934c767065a342a43c9ee1beac8430cdd3b2086f\n\nc0b094e46842260936d4b97ce63e4539b99a3eae48b736798c700217c52569d\n\n069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce\n\nSee TanStack post-mortem\n\nNot published\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nEnvironment\n\nAzure Functions / Durable\n\nTask workloads\n\nCI/CD pipelines (GitHub\n\nActions, Jenkins, GitLab)\n\nAWS EC2 fleets with SSM\n\nagent\n\nKubernetes clusters\n\nRisk Level Exposure Reason\n\ndurabletask imported at cold start before user code runs\nCritical\n— payload fires automatically on any Linux host\n\nCloud credentials, publish tokens, and GitHub PATs in\n\nCritical environment — primary theft target; worm propagation\n\nconfirmed\n\nSSM SendCommand propagation to up to 5 instances per\nCritical\ninfected host — exponential spread potential\n\nkubectl exec propagation into up to 5 pods per infected\nCritical\nworkload\n\nCredential files, SSH keys, Docker credentials, .env files,\nDeveloper machines (Linux) High\n\nGitHub Actions workflows\nHigh\npublishing to PyPI/npm\n\nVS Code users (all Medium–\n\nplatforms) High\n\ndurabletask pulls roughly 417,000 downloads a month, according to Endor Labs. Any Linux system that upgraded past 1.4.0\n\nbefore the packages were yanked should be treated as fully compromised. Azure Durable Functions runs in exactly the kinds\n\nof environments where production cloud credentials exist: workflow automation, document processing, AI agent\n\ninfrastructure.\n\nAI tooling configs\n\nPublishing token theft enables further package\n\ncompromise — the worm’s self-replication mechanism\n\nPoisoned extension vector used against GitHub employee;\n\nany developer with auto-update enabled is at risk\n\nPhoenix PHX-Neural scored durabletask at 61/100 (COMPROMISE, Analysis Under Review), with 12 of 85 detection rules\n\nfiring: Payload Download, Unencrypted Communication, and DGA/Dynamic C2 Resolution. The related azure-mgmt-\n\ndurabletask package scored 100/100; both Analyst and Judge confirmed it as a legitimate Microsoft Azure SDK component\n\nwith all signals suppressed as false positives.\n\nDetection Guidance\n\nImmediate Verification Commands\n\n# Check installed version\n\npip show durabletask\n\n# Scan lockfiles\n\ngrep -r ‘durabletask’ requirements*.txt poetry.lock Pipfile.lock uv.lock 2\u003e/dev/null\n\n# Check for dropped payload on disk\n\nls -la /tmp/managed.pyz 2\u003e/dev/null\n\n# Check for worm propagation markers\n\nls ~/.cache/.sys-update-check ~/.cache/.sys-update-check-k8s 2\u003e/dev/null\n\n# Check for persistence service\n\nsystemctl status pgsql-monitor.service 2\u003e/dev/null\n\nls /usr/bin/pgmonitor.py ~/.local/bin/pgmonitor.py 2\u003e/dev/null\n\n# Scan installed package for injected code\n\ngrep -r ‘git-service.com’ $(pip show durabletask | grep Location | awk ‘{print $2}’) 2\u003e/dev/null\n\nLog and Network Indicators\n\nPage 12 of 17\n\nDNS / proxy logs:\n\nBlock *.git-service[.]com and *.m-kosche[.]com at the domain level.\n\nProcess creation:\n\nstdout/stderr redirected to /dev/null.\n\nNetwork egress:\n\nIPs in 83.142.209.0/24.\n\nGitHub API calls:\n\ncreation with Russian folklore names (BABA-Y\n\ncreation.\n\nAWS CloudTrail:\n\nUnexpected Secrets Manager or SSM Parameter Store GetSecretV\n\nKubernetes audit logs:\n\nSystemd: New service pgsql-monitor.service registered, described as ‘PostgreSQL Monitor’\n\npersistence payload.\n\nIOC Reference Table\n\nIndicator\n\nType\n\nPyPI\n\npackage\n\nPyPI\n\npackage\n\nPyPI\n\npackage\n\nFile hash\n\n(SHA-256)\n\nFile hash\n\n(SHA-256)\n\nFile hash\n\n(SHA-256)\n\nFile hash\n\n(SHA-256)\n\nDomain\n\nDomain\n\nDomain\n\nwildcard\n\nDomain\n\nwildcard\n\nURL\n\nURL\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nAny query to check.git-service[.]com or t.m-kosche[.]com is a confirmed compromise indicator.\n\npython3 /tmp/managed.pyz launched as a detached process (start_new_session=True) with\n\nOutbound HTTPS POST to check.git-service[.]com/api/public/version; outbound connections to\n\nCommit search queries for ‘FIRESCALE’ from non-GitHub infrastructure. Public repository\n\nAGA, KOSCHEI, FIREBIRD, etc.) followed by results.json file\n\nssm:SendCommand events using AWS-RunShellScript document from compromised instance.\n\nalue/GetParameter calls across multiple regions.\n\nkubectl exec commands originating from unexpected source pods.\n\nIndicator\n\ndurabletask==1.4.1\n\ndurabletask==1.4.2\n\ndurabletask==1.4.3\n\n3de04fe2a76262743ed089efa7115f4508619838e77d60b9a1aab8b20d2cc8bf\n\n85f54c089d78ebfb101454ec934c767065a342a43c9ee1beac8430cdd3b2086f\n\nc0b094e46842260936d4b97ce63e4539b99a3eae48b736798c700217c52569dc\n\n069ac1dc7f7649b76bc72a11ac700f373804bfd81dab7e561157b703999f44ce\n\ncheck.git-service[.]com\n\nt.m-kosche[.]com\n\n*.git-service[.]com\n\n*.m-kosche[.]com\n\nhttps://check.git-service[.]com/rope.pyz\n\nhttps://check.git-service[.]com/v1/models\n\nPage 13 of 17\n\n— cover identity for\n\nNotes\n\nMalicious — do\n\nnot install\n\nMalicious — do\n\nnot install\n\nMalicious — do\n\nnot install\n\ndurabletask-\n\n1.4.1.tar.gz\n\ndurabletask-\n\n1.4.2.tar.gz\n\ndurabletask-\n\n1.4.3.tar.gz\n\nrope.pyz second-\n\nstage payload\n\nPrimary C2 and\n\npayload delivery\n\n— block domain\n\nSecondary payload\n\ndelivery — block\n\ndomain\n\nBlock full domain\n\n— subdomains\n\nused for exfil\n\nBlock full domain\n\n— subdomains\n\nmay be used\n\nPayload download\n\nC2 check-in /\n\nwiper activation\n\nendpoint\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nIndicator\nIndicator Notes\nType\n\nPrimary\n\nURL https://check.git-service[.]com/api/public/version exfiltration\n\nendpoint\n\nURL https://check.git-service[.]com/audio.mp3 Wiper audio file\n\nFallback payload\nURL https://t.m-kosche[.]com/rope.pyz\ndelivery\n\nTeamPCP C2\n\nsubnet —\nIP range 83.142.209.0/24\nconfirmed across\n\nall waves\n\nIP address 83.142.209.194 TanStack wave C2\n\nMarch 2026\n\nIP address 83.142.209.11 Checkmarx/Telnyx\n\nC2\n\nMarch 2026\n\nIP address 83.142.209.203 Checkmarx/Telnyx\n\nC2\n\nDropped payload\n\n— confirmed\nFile path /tmp/managed.pyz\ncompromise\n\nindicator\n\nWorm propagation\n\nFile path ~/.cache/.sys-update-check marker (AWS\n\nSSM)\n\nWorm propagation\n\nFile path ~/.cache/.sys-update-check-k8s marker\n\n(Kubernetes)\n\nPersistence\n\nFile path /usr/bin/pgmonitor.py payload (root\n\ninstall)\n\nPersistence\n\nFile path ~/.local/bin/pgmonitor.py payload (non-root\n\ninstall)\n\nPersistence service\n\nService — disguised as\npgsql-monitor.service\nname PostgreSQL\n\nMonitor\n\nDead-drop beacon\nGitHub\nFIRESCALE \u003cbase64\u003e.\u003cbase64\u003e in public commit\npattern\nmessages\n\nRussian folklore\n\nGitHub names —\nBABA-YAGA, KOSCHEI, FIREBIRD, PTITSA, RUSALKA, MOROZKO,\nrepo exfiltration repos\nLESHY\nnames created with stolen\n\ntokens\n\nPage 14 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nIndicator\nIndicator Notes\nType\n\nThree days before\nDomain\ngit-service[.]com registered 2026-05-16 attack; NameSilo,\nregistration\nprivacy-guarded\n\nScanner References\n\nPhoenix Security scanner: github.com/Security-Phoenix-demo/Shai-Hulud-Sha1-Hulud-V2-npm-compromise-\n\nscanner\n\nPhoenix PHX-Neural scored durabletask 0.0.0.dev73 at 61/100 — 12 of 85 detection rules triggered. Live tracking:\n\nsha1hulud-phoenix.pplx.app\n\nEndor Labs: Detected durabletask 1.4.1 within 2 minutes of publication (16:19 to 16:21 UTC)\n\nAikido Security: Behavioral analysis of rope.pyz payload documented\n\nStepSecurity: SSM propagation mechanics documented\n\nWiz: Root cause analysis of PyPI token compromise vector\n\nSafeDep: 28KB Python stealer analysis including HashiCorp Vault KV and password manager targeting\n\nHunt.io: C2 infrastructure correlation across all TeamPCP waves\n\nSBOM scanning: Any SBOM containing durabletask without explicit version == 1.4.0 pin should be flagged\n\nImmediate Actions\n\n1. 1. Pin durabletask to 1.4.0: pip install durabletask==1.4.0. If using poetry: poetry add durabletask@1.4.0. If using\n\nuv: uv add durabletask==1.4.0. Do not install 1.4.1, 1.4.2, or 1.4.3.\n\n2. 2. Check for active compromise: Run ls -la /tmp/managed.pyz. If the file exists, the payload ran. Isolate the host\n\nimmediately before credential rotation.\n\n3. 3. Check propagation markers: ls ~/.cache/.sys-update-check \u0026\u0026 ls ~/.cache/.sys-update-check-k8s. Presence\n\nconfirms the worm’s lateral movement logic ran.\n\n4. 4. Rotate all credentials on affected hosts: AWS IAM keys, session tokens (check CloudTrail for unexpected API\n\ncalls). Azure service principal credentials, managed identity tokens. GCP service account keys (check audit logs).\n\nKubernetes service account tokens and kubeconfig. HashiCorp Vault tokens. 1Password and Bitwarden sessions.\n\nGitHub tokens/PATs (check for new public repos with Russian folklore names). npm, pip, PyPI tokens. SSH private\n\nkeys. CI/CD pipeline secrets. Contents of any .env files accessible to the process.\n\n5. 5. Block C2 infrastructure: Add check.git-service[.]com, *.git-service[.]com, t.m-kosche[.]com, *.m-kosche[.]com\n\nto DNS blocklists and egress proxy deny lists. Block 83.142.209.0/24 at network egress.\n\n6. 6. Check for persistence: systemctl status pgsql-monitor.service. If found: systemctl stop pgsql-monitor.service \u0026\u0026\n\nsystemctl disable pgsql-monitor.service \u0026\u0026 rm /etc/systemd/system/pgsql-monitor.service \u0026\u0026 rm\n\n/usr/bin/pgmonitor.py (or ~/.local/bin/pgmonitor.py).\n\n7. 7. Audit VS Code extensions: Review all installed extensions across developer and CI machines. Any extension\n\nwith network access that was auto-updated recently warrants manual review of the published version’s source.\n\n8. 8. Check AWS SSM propagation: Review CloudTrail for ssm:SendCommand events using AWS-RunShellScript\n\nfrom any compromised instance. Investigate all target instances as potentially infected.\n\nTemporary Mitigations (If Immediate Patching Is Delayed)\n\nRestrict outbound egress from CI runners and cloud workloads to known-good domains. The dropper requires DNS\n\nresolution of check.git-service[.]com to execute the payload.\n\nImplement pip –require-hashes with a pinned requirements file. A hash mismatch on 1.4.1–1.4.3 would have failed\n\nthe build before any code ran.\n\nDisable auto-update on VS Code extensions in developer environments pending review.\n\nMonitor for the FIRESCALE pattern in GitHub commit search API calls originating from your infrastructure.\n\nRestrict SSM agent permissions using AWS IAM policy conditions to limit lateral movement blast radius.\n\nLonger-Term Hardening\n\nEnforce minimum release age controls on package managers (OpenAI deployed this as a post-Axios control — the\n\ntwo affected employee devices had not yet received the updated configuration).\n\nRequire SBOM generation and signing for all builds. Alert on transitive dependency version changes between builds.\n\nPage 15 of 17\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nScope CI pipeline permissions to least privilege. Credential harvesting only pays off when those credentials exist on\n\nthe build machine.\n\nReview all package __init__.py files for network calls. SDKs do not make outbound connections at import time. Any\n\nurllib, requests, or subprocess call in a package’s __init__.py warrants investigation.\n\nImplement GitHub Actions permissions pinning (pin actions to commit SHA, not tag) to prevent workflow token\n\nexfiltration via tampered action versions.\n\nPhoenix Security Platform Recommendations\n\nTraditional CVE-based scanners have no record of any package in this campaign. No CVEs exist for durabletask 1.4.1–\n\n1.4.3, the VS Code extension, or the TanStack wave. PHX-Neural flagged durabletask on behavioral signals alone, without a\n\nCVE to match against.\n\nSupply chain compromise detection: Phoenix PHX-Neural behavioral analysis flagged durabletask as\n\nCOMPROMISE-tagged with 12 behavioral signals triggered. This detection does not depend on CVE assignment —\n\nit operates on package behavior, network call patterns, and code heuristics. Teams using Phoenix’s package\n\nintelligence feed received a COMPROMISE signal on durabletask within the publication window.\n\nFIRESCALE campaign tracking: Phoenix maintains active tracking of the Mini Shai-Hulud / FIRESCALE\n\ncampaign lineage at sha1hulud-phoenix.pplx.app with live IOC feeds and affected package lists. Package intelligence\n\nat phxintel.security/package.html provides per-package assessment against known campaign IOCs.\n\nReachability analysis: For teams where durabletask is a transitive dependency, Phoenix reachability analysis\n\nidentifies which workloads actually import the package at runtime versus which have it in the dependency graph but\n\nnever execute it. This narrows remediation prioritization to environments where the payload would have fired.\n\nAttack surface management: Phoenix ASM identifies internet-facing services and CI pipelines running affected\n\npackage versions. For the GitHub breach vector, identifying which developer machines and CI runners had the\n\ncompromised VS Code extension installed — and which repositories those machines had access to — defines the\n\nblast radius for credential rotation.\n\nRemediation campaigns: Create a TeamPCP Wave Four remediation campaign in Phoenix, assign owners by\n\nrepository and team, track the pin-to-1.4.0 fix across all services, and verify remediation via SBOM re-scan. The\n\ncredential rotation scope (AWS, Azure, GCP, GitHub, V\n\nconfirmed exposure list.\n\nPhoenix maps compromise signals to actual workload exposure: which pipelines ran affected packages, which developers\n\nhad the extension, which repositories were in scope for credential rotation. The campaign is sprawling. The remediation\n\nbacklog shouldn’t be.\n\nMITRE ATT\u0026CK Mapping\n\nTechnique\nName\nID\n\nSupply Chain Compromise:\n\nT1195.001 Compromise Software\n\nDependencies\n\nCommand and Scripting Interpreter:\nT1059.006\nPython\n\nault) can be tracked per-service against the reachability-\n\nDescription\n\nMalicious versions of durabletask, TanStack\n\npackages published via stolen PyPI/npm tokens\n\nrope.pyz executes Python modules for credential\n\ntheft, propagation, and persistence\n\nT1078 Valid Accounts\n\nT1552 Unsecured Credentials\n\nRemote Services: Cloud Services\nT1021.007\n(SSM)\n\nContainer Administration\nT1609\nCommand (kubectl exec)\n\nT1041 Exfiltration Over C2 Channel\n\nPage 16 of 17\n\nStolen GitHub tokens, cloud credentials used for\n\nlateral movement and exfiltration\n\nCredential files (~/.aws, ~/.kube, ~/.vault-token,\n\n.env, Docker socket, etc.) harvested\n\nAWS SSM SendCommand used to propagate\n\nworm to up to 5 EC2 instances per infected host\n\nKubernetes pod lateral movement via kubectl\n\nexec\n\nEncrypted credential bundles POSTed to\n\ncheck.git-service[.]com\n\nhttps://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nTechnique\nName\nID\n\nT1567.001 Exfiltration to Code Repository\n\nApplication Layer Protocol: Web\nT1071.001\nProtocols\n\nT1485 Data Destruction\n\nBoot or Logon Autostart: Systemd\nT1547.001\nService\n\nWeb Service: Dead Drop Resolver\nT1102.001\n(GitHub)\n\nExternal References\n\n1. GitHub statement on internal repository compromise (May 20, 2026) — @github on X\n\n2. Wiz: durabletask compromise analysis — ‘The attacker compromised a GitHub account via a previous attack, dumped\n\nGitHub secrets…’ (May 19, 2026)\n\n3. Endor Labs: durabletask malicious package analysis — detection within 2 minutes of 1.4.1 publication (May 19, 2026)\n\n4. Aikido Security: rope.pyz payload behavioral analysis — SSM propagation, kubectl exec, roulette.py wiper\n\n5. StepSecurity: SSM SendCommand propagation mechanics and FIRESCALE documentation\n\n6. SafeDep: 28KB Python stealer module analysis including HashiCorp V\n\nDescription\n\nGitHub token abuse to create exfiltration\n\nrepositories with Russian folklore names\n\nHTTPS used for C2, payload delivery, and\n\nexfiltration\n\nrm -rf /* on Israeli/Iranian-fingerprinted hosts via\n\nroulette.py\n\npgsql-monitor.service persistence registered as\n\n‘PostgreSQL Monitor’\n\nFIRESCALE mechanism uses GitHub commit\n\nsearch API for C2 rotation with RSA-signed\n\nURLs\n\nault and password manager targeting\n\n7. Hunt.io: C2 infrastructure correlation — 83.142.209.0/24 subnet across all TeamPCP waves (May 16, 2026)\n\n8. The Hacker News: ‘GitHub Investigating TeamPCP Claimed Breach of ~4,000 Internal Repositories’ (May 20, 2026)\n\n9. The Hacker News: ‘TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates’ (May\n\n16, 2026)\n\n10. OpenAI: ‘Our response to the TanStack npm supply chain attack’ — openai.com/index/our-response-to-the-tanstack-\n\nnpm-supply-chain-attack (May 15, 2026)\n\n11. BleepingComputer: ‘OpenAI confirms security breach in TanStack supply chain attack’ (May 14, 2026)\n\n12. Socket Security: TanStack compromise attribution to Mini Shai-Hulud operation\n\n13. Phoenix Security scanner (Shai-Hulud): github.com/Security-Phoenix-demo/Shai-Hulud-Sha1-Hulud-V2-npm-\n\ncompromise-scanner\n\n14. Phoenix Security live tracking: sha1hulud-phoenix.pplx.app — Mini Shai-Hulud campaign IOC feed\n\n15. Phoenix Package Intelligence: phxintel.security/package.html\n\n16. Phoenix Security editorial archive: phoenix.security/?s=sha1\n\n17. @xploitrsturtle2 (box turtle / shai-huturtle, linked to TeamPCP) — ‘Github knew for hours, they delayed telling you and\n\nthey won’t be honest in the future.’ X post, 3:40 AM May 20, 2026. x.com/xploitrsturtle2/status/2056927898771067006\n\nSource: https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/\n\nPage 17 of 17",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"
	],
	"report_names": [
		"teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026"
	],
	"threat_actors": [
		{
			"id": "2864e40a-f233-4618-ac61-b03760a41cbb",
			"created_at": "2023-12-01T02:02:34.272108Z",
			"updated_at": "2026-10-20T02:00:17.878355Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "ETDA:WildCard",
			"tools": [
				"RustDown",
				"SysJoker"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "256a6a2d-e8a2-4497-b399-628a7fad4b3e",
			"created_at": "2023-11-30T02:00:07.299845Z",
			"updated_at": "2026-10-20T02:00:18.105375Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "MISPGALAXY:WildCard",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "dcbff54d-13ec-40b5-b3b9-b74a315669e1",
			"created_at": "2026-02-03T02:00:03.428641Z",
			"updated_at": "2026-10-20T02:00:22.388866Z",
			"deleted_at": null,
			"main_name": "UNC1069",
			"aliases": [
				"MASAN",
				"CryptoCore",
				"MIDNIGHT NEPTUNE"
			],
			"source_name": "MISPGALAXY:UNC1069",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "be9c5ae2-a892-4e9a-a570-3f7f3cc4b392",
			"created_at": "2026-08-06T02:00:04.114975Z",
			"updated_at": "2026-10-20T02:00:12.467819Z",
			"deleted_at": null,
			"main_name": "TeamPCP",
			"aliases": [
				"TeamPCP",
				"PCPCat",
				"ShellForce",
				"DeadCatx3",
				"SHADOW-WATER-058",
				"UNC6780"
			],
			"source_name": "MITRE:TeamPCP",
			"tools": [
				"CanisterWorm",
				"Mini Shai-Hulud",
				"TeamPCP Cloud Stealer"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "63883709-27b5-4b65-9aac-c782780fbb28",
			"created_at": "2026-04-10T02:00:03.996704Z",
			"updated_at": "2026-10-20T02:00:23.13768Z",
			"deleted_at": null,
			"main_name": "TeamPCP",
			"aliases": [
				"PCPcat",
				"ShellForce",
				"DeadCatx3",
				"CanisterWorm",
				"Altered Spider"
			],
			"source_name": "MISPGALAXY:TeamPCP",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1785981789,
	"ts_updated_at": 1792487196,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/501002a97254d8054e52af345fcb1e803a5c2519.pdf",
		"text": "https://archive.orkl.eu/501002a97254d8054e52af345fcb1e803a5c2519.txt",
		"img": "https://archive.orkl.eu/501002a97254d8054e52af345fcb1e803a5c2519.jpg"
	}
}