Poisoned Pipeline / Incidents / AS92
durabletask PyPI multi-cloud credential stealer
SafeDep found a malicious durabletask on PyPI (not Microsoft’s
Durable Task) that stole multi-cloud credentials and included worm-like
propagation. Name collision with a well-known Azure/orchestration
library.
Mapped techniques
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0184 Harvesting sensitive information from files
supply-chain pypi name collision
durabletask name collision on PyPI.
Multi-cloud stealer with worm-like spread.
Cloud credentials harvested from the host.
Sources
- https://safedep.io/malicious-durabletask-pypi-supply-chain-attack
- https://www.stepsecurity.io/blog/microsofts-durabletask-pypi-package-compromised-in-supply-chain-attack
- https://www.aikido.dev/blog/durabletask-package-compromised-mini-shai-hulud
- https://www.wiz.io/blog/durabletask-teampcp-supply-chain-attack