PyPI/durabletask: unknown
durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account
Action: No fix published. Pin and monitor.
Affected
No affected ranges in the source.
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-207
- https://github.com/microsoft/durabletask-python/issues/137
- https://safedep.io/malicious-durabletask-pypi-supply-chain-attack
- https://bad-packages.kam193.eu/pypi/campaign/2026-05-compr-durabletask
- https://www.upwind.io/feed/newly-discovered-durabletask-malware-targeted-kubernetes-cloud-secrets-and-ci-cd-infrastructure
- https://www.aikido.dev/blog/durabletask-package-compromised-mini-shai-hulud
- https://www.wiz.io/blog/durabletask-teampcp-supply-chain-attack
- https://pypi.org/project/durabletask/
published · modified · JSON