For the 2nd time in weeks, Microsoft packages laced with credential stealer | TheBriefWire
For the 2nd time in weeks, Microsoft packages laced with credential stealer
Published 8 June 2026 ¡ tech
Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened
Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents. In all, multiple researchers said, 73 packages were flagged as malicious when automated systems on GitHub blocked them on the platform.
Rather than noting they are maliciousâand that developers who used AI agents to work with them should assume their systems are compromisedâthe Microsoft-owned GitHub said it disabled the packages âdue to a violation of GitHub's terms of service.â The text went on to encourage the package owner to contact GitHub.
Devs: Assume compromise and proceed accordingly It wasnât until Monday that Microsoft even raised the possibility the packages were infected. In an email, the company
stated: âWe have temporarily removed some repositories as we investigate potential malicious content.â Read full article Comments
Published: June 9, 2026 ⢠12:04 AM IST ¡ Updated: June 9, 2026 ⢠1:36 AM ISTBy TheBriefWire Editorial Team
Key points
Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents.
In all, multiple researchers said, 73 packages were flagged as malicious when automated systems on GitHub blocked them on the platform.
Rather than noting they are maliciousâand that developers who used AI agents to work with them should assume their systems are compromisedâthe Microsoft-owned GitHub said it disabled the packages âdue to a violation of GitHub's terms of service.â The text went on to encourage the package owner to contact GitHub.
Devs: Assume compromise and proceed accordingly It wasnât until Monday that Microsoft even raised the possibility the packages were infected.
In an email, the company stated: âWe have temporarily removed some repositories as we investigate potential malicious content.â Read full article Comments
The BriefWire