{"id":9486,"date":"2026-06-09T12:01:21","date_gmt":"2026-06-09T12:01:21","guid":{"rendered":"https:\/\/news.theck1.no\/?p=9486"},"modified":"2026-06-09T12:01:21","modified_gmt":"2026-06-09T12:01:21","slug":"for-the-2nd-time-in-weeks-microsoft-packages-laced-with-credential-stealer","status":"publish","type":"post","link":"https:\/\/news.theck1.no\/?p=9486","title":{"rendered":"For the 2nd time in weeks, Microsoft packages laced with credential stealer"},"content":{"rendered":"<div style=\"margin-bottom:1em; color:#666; font-size:0.9em;\">\n<strong><br \/>\n                    Dan Goodin<br \/>\n                <\/strong><br \/>\n &bull;<br \/>\nJune 8, 2026\n<\/div>\n<hr\/>\n<p>Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents.<\/p>\n<p>In all, <a href=\"https:\/\/www.stepsecurity.io\/blog\/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents\">multiple<\/a> researchers <a href=\"https:\/\/opensourcemalware.com\/blog\/miasma-reaches-azure\">said<\/a>, 73 packages were flagged as malicious when automated systems on GitHub blocked them on the platform. Rather than noting they are malicious\u2014and that developers who used AI agents to work with them should assume their systems are compromised\u2014the Microsoft-owned GitHub said it disabled the packages \u201cdue to a violation of GitHub&#8217;s terms of service.\u201d The text went on to encourage the package owner to contact GitHub.<\/p>\n<h2>Devs: Assume compromise and proceed accordingly<\/h2>\n<p>It wasn\u2019t until Monday that Microsoft even raised the possibility the packages were infected. In an email, the company stated: \u201cWe have temporarily removed some repositories as we investigate potential malicious content.\u201d<\/p>\n<p><a href=\"https:\/\/arstechnica.com\/security\/2026\/06\/for-the-2nd-time-in-weeks-microsoft-packages-laced-with-credential-stealer\/\">Read full article<\/a><\/p>\n<p><a href=\"https:\/\/arstechnica.com\/security\/2026\/06\/for-the-2nd-time-in-weeks-microsoft-packages-laced-with-credential-stealer\/#comments\">Comments<\/a><\/p>\n<p style=\"margin-top:1.5em;\"><a href=\"https:\/\/arstechnica.com\/security\/2026\/06\/for-the-2nd-time-in-weeks-microsoft-packages-laced-with-credential-stealer\/\" target=\"_blank\" rel=\"noopener\">Read the full article &rarr;<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Dan Goodin &bull; June 8, 2026 Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents. In all, multiple researchers said, 73 packages were flagged as malicious when automated systems on GitHub blocked them on<\/p>\n<p class=\"more-link\"><a href=\"https:\/\/news.theck1.no\/?p=9486\" class=\"themebutton2\">READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-9486","post","type-post","status-publish","format-standard","hentry","category-artificial-intelligence"],"_links":{"self":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts\/9486","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9486"}],"version-history":[{"count":0,"href":"https:\/\/news.theck1.no\/index.php?rest_route=\/wp\/v2\/posts\/9486\/revisions"}],"wp:attachment":[{"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9486"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9486"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news.theck1.no\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9486"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}