A supply-chain attack aimed squarely at AI developers
Microsoft cut off access to dozens of its open-source GitHub projects after hackers apparently breached them and slipped in credential-stealing malware. At least 70 Microsoft projects were disabled, many tied to its Azure cloud service and to tooling developers use with AI coding apps.
How the attack worked
The mechanics are a textbook supply-chain compromise, the kind that's been hitting popular open-source code in recent months:
- The tainted projects included tools commonly used alongside AI coding apps such as Claude Code, Gemini's command-line interface, and VS Code.
- According to security firm Cloudsmith and the malware-analysis site OpenSourceMalware - among the first to flag it - the malware stole users' passwords and other credentials when the compromised tools were opened in those AI coding environments.
- It's not yet known how many people downloaded the affected tools, and the disabled repos now show GitHub's standard terms-of-service takedown notice.
Why this one stands out
Supply-chain attacks are advantageous to attackers precisely because the targeted code is reused across many products or by a specific kind of user - often people with access to cloud systems and large troves of customer data. What makes this case notable is the target: it's relatively rare for a giant like Microsoft, with deep defensive resources, to get breached this way, versus the solo open-source maintainers usually hit. More worrying, it's reportedly Microsoft's second open-source compromise in weeks - described as a re-compromise of its Durable Task project, which suggests either the attackers weren't fully evicted the first time or this is a fresh, distinct breach.
The takeaway for developers
The episode is a pointed reminder that the AI coding boom has widened the attack surface: the more developers wire third-party tools into Claude Code, Gemini, and VS Code workflows, the more those dependencies become a high-value target. The advice that follows from incidents like this is the unglamorous basics - scrutinize what you pull into your toolchain, rotate exposed credentials, and treat even big-vendor open-source code as something that can be compromised.