On May 19, 2026, the Microsoft durabletask Python SDK was compromised on PyPI, marking a significant supply chain attack. The attacker uploaded three malicious versions of the package (1.4.1, 1.4.2, and 1.4.3) within a short timeframe, bypassing Microsoft's GitHub repository's build pipeline using stolen publishing credentials. The malicious payload, consisting of 14 lines of Python code, acts as a dropper for a more complex modular cloud intrusion framework known as rope.pyz. This framework features multiple modules designed to exfiltrate sensitive data across major cloud platforms and systems, including AWS, Azure, and GCP.