phoenix.securityPublished
TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated
By Marcus Webb
Excerpt
Contents
Executive Summary
On May 19–20, 2026, two events landed within hours of each other. Wiz and Endor Labs documented three malicious versions of durabletask (1.4.1, 1.4.2, and 1.4.3) pushed to PyPI within a 35-minute window on May 19, the official Microsoft Azure Python SDK for the Durable Task workflow framework. The same day, GitHub confirmed that a poisoned VS Code extension on an employee device had led to the exfiltration of approximately 3,800 internal repositories. TeamPCP…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by phoenix.security on phoenix.security.
Mentioned in the excerpt
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
