For the 2nd time in weeks, Microsoft packages laced with credential stealer
| Source: Ars Technica AI
Tags: supply chain attack, Microsoft, npm, credential stealing, AI agents, TeamPCP, security, GitHub
73 Microsoft npm packages were silently poisoned with credential-stealing code that activates when an AI coding agent opens them — the second supply-chain attack on an official Microsoft repository in two months, linked to threat actor TeamPCP; the 28KB payload steals credentials from AWS, Azure, GCP, Kubernetes, and 90+ developer tool configurations before spreading laterally through cloud infrastructure.
Details
A serious supply-chain attack compromised 73 cryptographically verified open source packages from Microsoft late last week. The malware was specifically designed to trigger when developers open the packages in AI coding agents — a novel attack vector that exploits the autonomous file-access patterns of agentic development tools. The payload is 28KB and steals credentials from AWS, Azure, GCP, Kubernetes, password managers, and over 90 developer tool configuration files. After credential exfiltration, it spreads laterally through cloud infrastructure to infect additional developer machines. Researchers linked the attack to TeamPCP, the same threat actor responsible for compromising Microsoft's durabletask Python SDK on PyPI in mid-May — a package with 400,000 monthly downloads. GitHub (owned by Microsoft) blocked the packages but initially described the action as "a violation of GitHub's terms of service" rather than disclosing the malware. Microsoft did not raise the possibility of infection until Monday, leaving developers potentially exposed over the weekend. Security researchers explicitly stated that developers who used AI agents to work with the packages "should assume their systems are compromised." This is the second official Microsoft repository compromised in two months by the same threat actor. The attack surface is novel: AI coding agents open and process packages autonomously, creating a trigger mechanism that differs from traditional supply-chain attacks where code must be executed explicitly by a developer.