MALICIOUS (1) campaign cataloged at 2026-05-19(2).

1. The campaign has clearly malicious intent, like infostealers.
2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-05-compr-durabletask

During import of compromised versions, the malicious code is downloaded and executed. It exfiltrates all kinds of credentials and sensitive files, including data from secret and password managers, SSH keys, configuration files. Code tries to achieve a persistence via systemd unit.

Abuse categories

compromised-package

Campaign uses compromised-package.

exfiltration_cloud_tokens

Campaign uses exfiltration_cloud_tokens.

exfiltration_credentials

The package attempts to steal credentials, like passwords or API keys.

exfiltration_env_variables

Campaign uses exfiltration_env_variables.

exfiltration_ssh_keys

Campaign uses exfiltration_ssh_keys.

files_exfiltration

Campaign uses files_exfiltration.

persistence

Campaign uses persistence.

remote_script

Downloads and executes a remote malicious script.

References

Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.

• https://safedep.io/malicious-durabletask-pypi-supply-chain-attack

• https://www.upwind.io/feed/newly-discovered-durabletask-malware-targeted-kubernetes-cloud-secrets-and-ci-cd-infrastructure

• https://www.aikido.dev/blog/durabletask-package-compromised-mini-shai-hulud

IoCs & related URLs

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

• check.git-service.com

• git-service.com

• t.m-kosche.com

• m-kosche.com

• hxxps://t.m-kosche.com/rope.pyz

• hxxps://check.git-service.com/rope.pyz

• hxxps://check.git-service.com/api/public/version

• hxxps://check.git-service.com/v1/models

Packages in the campaign

campaign:2026-05-compr-durabletask

• durabletask