Microsoft Open Source Packages Compromised in Targeted Attack on AI Coding Agents

Table of Contents

Compromise of Verified Microsoft Packages

Dozens of cryptographically verified open source packages associated with Microsoft were altered late last week. Attackers inserted advanced credential-stealing code designed to activate specifically when developers interacted with the packages inside AI coding agents. The modifications targeted a range of repositories, including those linked to Azure Functions and other widely used tools.

Automated detection systems on GitHub identified 73 packages as malicious and blocked them from the platform. Researchers tracking the incident noted that the scale of the operation indicated a deliberate supply chain effort aimed at developers relying on AI-assisted workflows.

GitHub Response and Lack of Clarity

GitHub disabled the affected packages but attributed the action solely to a violation of its terms of service. The platform did not state that the packages contained malicious code or advise developers who had used AI agents with them to assume their systems were compromised. Instead, the notice encouraged the package owner to contact GitHub support for further information.

This approach left developers without immediate guidance on potential exposure. The decision to frame the takedown in terms of policy rather than security created uncertainty about the actual risk level during the initial response period.

due to a violation of GitHub's terms of service. — GitHub

Microsoft Acknowledgment and Developer Guidance

Microsoft did not publicly address the possibility of infection until the following Monday. In an email communication, the company stated that it had temporarily removed some repositories while investigating potential malicious content. This marked the second reported incident involving Microsoft packages in recent weeks.

Security researchers have advised developers to assume compromise if they interacted with the flagged packages through AI coding agents. Organizations are encouraged to review access logs, rotate credentials, and monitor for unusual activity rather than waiting for additional confirmation from the platforms involved.