GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE

What it is

A Raven File writeup of the May 2026 TeamPCP leak that BreachForums-advertised ~4K GitHub private repos (posted 19 May 2026). Beyond the two dissected Rails controllers, the page carries concrete indicators for the associated supply-chain attack on Microsoft's durabletask Python client and TeamPCP infrastructure — details the catalog summary does not list.

Preconditions / Affected

• durabletask (Microsoft's official Python client for the Durable Task workflow framework) — the page says it was compromised via a lookalike domain. Anyone who installed/updated it around 19 May 2026 should check.
• The leak itself: an ~283KB github-repos.txt listing (repos extracted 18–19 May 2026) plus samples.zip (the two .rb controllers), distributed via LimeWire links set to expire in 7 days — so the original drop is likely already dead; expect re-hosts.

What to do

Hunt for these IOCs (the summary names the domain but not the hashes or onion, and the page flags the files as not yet detected by AV):

Lookalike domain (registered 16 May 2026):

git-service.com

Malicious durabletask files (MD5), both first seen 19 May 2026:

907a5a883877808218686bc24b7add65
b0e85aaafbd37dcaccc6ee734270ebbe

TeamPCP dark-web contact:

22evxpggnkyrxpluewqsrv5j4jtde6hut2peq3w44d6ase676qlkoead.onion

Attribution pivot per the page: TeamPCP's Session ID / TOX socials are reused on CypherForce Ransomware, and they operate on Telegram under the tagline "The Cats Hijacking Your Supplychains."

Caveats

• The controller analysis is AI-generated, manually cross-checked by the author's own admission — treat the architectural claims (Voltron, JA3 rate limiting, cluster counts) as unverified secondary reads of leaked source, not confirmed GitHub facts.
• The ~4K-repo figure and "GitHub internal source" framing are TeamPCP's claim; the page reports GitHub "tweeted they are investigating" but shows no confirmation of scope or authenticity.
• Both malware hashes were "not yet flagged" at writing — absence from your AV console is not evidence of safety.
• This is a living post the author says will be updated; the IOCs above are a point-in-time snapshot.