aikido.devwriteup

Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again!

Aikido Security reports that Microsoft's durabletask package on PyPI was compromised in a new "mini" wave of the Shai Hulud self-propagating supply-chain worm, which previously hit npm packages and spreads by stealing credentials and republishing malicious versions of dependencies. The post covers indicators of compromise, the malicious payload behavior, and which packages/versions are affected.