Dozens of Microsoft's open source projects on GitHub were hacked and injected with malware. The malware steals passwords and credentials from developers using AI coding tools.
Dozens of Microsoft's open source projects on GitHub were hacked and injected with password-stealing malware. The affected projects are related to Azure cloud services and AI development tools such as Claude Code, Gemini CLI, and VS Code. Microsoft has temporarily removed the repositories and is investigating.
This attack is a supply chain attack targeting widely used open source projects to distribute malware to many users. AI developers are prime targets because they often have access to cloud systems and large amounts of customer data. Microsoft's Durable Task project was also hacked in mid-May, and this incident may be a re-compromise of that project.
Even a large tech company like Microsoft is vulnerable to open source supply chain attacks. As AI development tools gain popularity, security threats targeting the ecosystem are likely to increase. Developers should always verify code from trusted sources and use security tools to check for malware.
The article covers the supply chain attack on Microsoft's open-source tools that stole passwords from AI developers. The HN community pointed out this as another example of supply chain vulnerabilities. Comments highlighted the risk of excessive software dependencies, and a specific list of 73 disabled Microsoft repositories was shared. Some users criticized the microservices and micro-libraries trend as recklessly propagated by FAANG developers.