Microsoft packages laced with credential stealer for second time

For the second time in weeks, Microsoft packages containing a credential stealer reached developers. The 73 packages reportedly ran a self-replicating stealer as soon as they were opened by an AI agent.

73 malicious packages surfaced on GitHub. Researchers reported that automated GitHub systems flagged all 73 as malicious and blocked them from the platform. Instead of warning that the packages were malicious and that anyone who opened them via AI coding agents should treat their systems as compromised, the Microsoft-owned service attributed the action to a violation of its terms of service. The notice urged the package owner to reach out to GitHub support.

Developers were advised to assume their environments had been breached and act accordingly. Microsoft did not acknowledge the possible infection until the following Monday. In a company email the firm said: “We have temporarily removed some repositories as we investigate potential malicious content.”

This marks the second supply-chain attack on a Microsoft repository in as many months. StepSecurity reported in mid-May that Microsoft’s durabletask Python SDK on PyPI had been compromised. The SDK serves as a framework for building fault-tolerant workflows and orchestrations used to automate distributed transactions and similar processes. It sees approximately 400,000 downloads each month.

The infected packages delivered a 28 KB payload targeting credentials stored for AWS, Azure, GCP, Kubernetes, password managers, and more than 90 developer tool configurations. The code then moved laterally across cloud environments to reach additional developer workstations. Researchers have tied the campaign to a threat actor tracked as TeamPCP. The durabletask package was altered after the attacker obtained Microsoft publishing credentials, a method that sidestepped the repository’s normal build pipeline.

The malware is tracked as Miasma and clones an open-sourced toolkit. The worm is a modified version of TeamPCP’s recently released Mini Shai-Hulud toolkit. Cloudsmith analysts said the code collects OIDC tokens employed in SLSA provenance attestation, which supplies cryptographically signed assurances of software integrity.

Just as in the May durabletask incident, last week’s attack stole a valid Microsoft OIDC token. The same technique previously tainted dozens of Red Hat packages. “The genius of this Miasma worm lies in how it adhered to legitimate workflows,” Cloudsmith said. “It does not exploit any software vulnerability in GitHub or npm. Instead, it exploits the underlying trust model of the modern engineering ecosystem.”

The firm explained that stolen developer credentials enabled a legitimate GitHub OIDC token request. That token then signed a malicious build carrying valid SLSA provenance, causing scanners to treat the update as routine and trusted. Because the worm impersonated an authenticated maintainer, it evaded conventional detection. Miasma also encrypts each payload uniquely, rendering hash-based indicators ineffective as signatures differ for every version.

Andrew McNamara of Red Hat detailed in a blog post where SLSA’s protections fall short. Earlier versions of Mini Shai-Hulud concentrated on scraping local secrets, but Miasma includes specialized collectors aimed at cloud identities in GCP and Azure. The malware attempts to gather every accessible cloud credential from infected developer machines and CI/CD runners, signaling the actors’ goal of pivoting from code repositories into live production environments. The credential-stealing routine activates the moment a developer opens any of the packages inside AI agents such as Claude Code, Gemini CLI, Cursor, or VS Code.