🧰 durabletask

The items that name it 10

• Top 10 attacks on Claude Code and what each one actually broke
  writeupas classification.key entities2026-09-23
• The State of Open Source Supply Chain Attacks
  articleas affected products2026-08-23It is written here as durabletask (PyPI).

  Microsoft's package compromised on PyPI.

• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeupas affected products2026-06-09It is written here as durabletask (PyPI package).

  Official Python SDK for Azure Durable Functions, downloaded over 400,000 times per month; compromised with malicious versions uploaded directly to PyPI on May 19, 2026, bypassing GitHub CI/CD; safe version is 1.4.0

• Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents
  writeupas affected products2026-06-09It is written here as durabletask (PyPI package).

  PyPI package

• Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds
  writeupas affected products2026-06-06It is written here as durabletask (PyPI).

  Microsoft's official Azure Durable Task SDK, ~417,000 downloads/month; malicious versions 1.4.1, 1.4.2, 1.4.3 pushed directly to PyPI on May 19 in a 35-minute window with no matching GitHub tags/releases/CI runs; yanked within hours

• Why EDR and proxy won’t save you from supply chain malware
  articleas affected products2026-06-02

  Python package in Microsoft's Azure ecosystem; three versions backdoored

• The Wild West of VS Code extensions and how a poisoned extension breached GitHub
  articleas affected products2026-05-20It is written here as durabletask (PyPI package).

  Referenced as a recent supply chain compromise that a publish-to-install delay would have caught.

• GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE
  writeupas affected products2026-05-20It is written here as DurableTask (Microsoft Python client for Durable Task workflow execution framework).

  Compromised via look-alike domain git-service.com registered 16 May 2026; 2 unflagged malicious files found, seen 19 May 2026

• Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again!
  writeupas classification.technologies2026-05-19
• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas affected productsIt is written here as durabletask (PyPI package, Microsoft).

  Trojanized PyPI package owned by Microsoft, published using compromised credentials for an official Microsoft SDK; malicious version was live for a 35-minute window between publication and discovery before being reported as a CVE.