AI & Machine Learning
Jun 8, 2026
Microsoft's Open Source Packages Compromised with Credential-Stealing Code
Jun 8, 2026
AI Summary
A total of 73 open source packages from Microsoft were found to contain malicious code designed to steal credentials. The packages were flagged by GitHub's automated systems, which disabled them due to a violation of terms of service, prompting developers to assume their systems may be compromised.
- Dozens of open source packages from Microsoft were compromised with credential-stealing code.
- The malicious code was activated when developers opened the packages in AI coding agents.
- GitHub's automated systems flagged 73 packages as malicious and disabled them.
- GitHub stated the packages were disabled for violating terms of service, without initially informing users of the potential compromise.
- Microsoft later acknowledged the issue, stating they are investigating the malicious content.
microsoftcredential theftai agentcybersecuritymalware