TeamPCP durabletask PyPI Worm Execution (May 2026)

Danny Y@zendannyy

•updated Jun 3, 2026•0•0•17

Detects post-install execution of the TeamPCP-compromised Microsoft durabletask package (v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via ~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM and kubectl exec.