Microsoft Faces Second Credential Stealing Attack on Open Source Packages

Microsoft's open source packages were compromised last week, adding advanced credential-stealing code that activated when developers interacted with them using AI coding agents. A total of 73 packages were flagged as malicious by GitHub's automated systems. While GitHub initially cited a violation of terms for disabling the packages, it was not until later that Microsoft acknowledged the attack, linked to the threat actor TeamPCP. The malware, known as Miasma, exploits the trust model of the engineering ecosystem rather than software vulnerabilities, allowing it to execute a payload that steals credentials from various platforms and spreads through cloud infrastructures.