A recent incident saw dozens of cryptographically verified open-source packages from Microsoft tainted with credential-stealing code. The affected repositories were flagged by automated systems on GitHub but disabled without clear explanation to users, leaving developers in limbo.

This is the second supply-chain attack of its kind in as many months, following a similar breach in mid-May that compromised Microsoft’s durabletask Python SDK. The latest malware, dubbed Miasma, targets over 90 developer tools and spreads through cloud infrastructures, posing significant security risks to developers worldwide.

The incident highlights the vulnerability of even established repositories to sophisticated attacks. Security experts warn that developers must assume their systems are compromised if they use potentially infected packages, regardless of GitHub’s response.

Microsoft only acknowledged the issue on Monday, stating it has temporarily removed some repositories while investigating potential malicious content. The compromise used a clone of TeamPCP's Mini Shai-Hulud toolkit and harvested OIDC credentials, demonstrating the depth of threat posed by such attacks.

The wider implications are concerning, as these packages were widely used in AI development workflows. This incident underscores the need for enhanced security measures and more transparent communication between developers and platform providers to mitigate future risks.