Last week, Microsoft shut down 73 of its own GitHub repositories following a malware attack that would steal developers’ credentials when opened in AI coding agents such as Claude Code, Gemini CLI, or Cursor. 

As reported by 404 Media, researchers from StepSecurity stated the affected GitHub repositories were shuttered after a malicious commit was uploaded to the durabletask repository. 

Microsoft still hasn’t revealed how many developers have been affected, as experts say the incident points to a bigger industry problem. 

Still no word on who’s been affected

Though 73 GitHub repositories were taken down, there’s been very little information about the fallout. 

As reported by Ars Technica, Microsoft-owned GitHub stated the repositories were disabled “due to a violation of GitHub’s terms of service.” When asked why its notice described a simple terms-of-service violation and neglected to warn developers of potential risks, GitHub did not respond to The New Stack. 

On Monday, three days after the malware attack hit, Microsoft seemed to own up to the incident, telling 404 Media: “We have temporarily removed some repositories as we investigate potential malicious content.” 

When asked how many developers accessed the affected repositories during the compromise window, a Microsoft spokesperson tells The New Stack, “We notified a small number of customers who may have pulled down content from the affected repositories.”

“We temporarily removed some repositories as we investigated potential malicious content. All of these repos have been restored after review,” a Microsoft rep says.

Déjà vu for Microsoft? 

This month’s malware attack comes on the heels of earlier trouble for Microsoft. As reported by 404 Media, threat actor TeamPCP had already compromised Microsoft’s durabletask by publishing three malicious versions. 

“I think their more important disclosure will need to be that we can trust their publishing pipelines and open-source repos again, and that is a real challenge.” 

According to OpenSourceMalware, the attack is a re-compromise of its May forebearer — but it’s not clear how hackers were able to do their dirty work the second time, i.e., whether Microsoft never completed the proper remediation clean-up, thereby leaving room for new intrusions, or if the June attack represents an entirely new kind of breach. 

When asked to examine the available facts, Nilesh Jain, co-founder and CEO, CleanStart, tells The New Stack it’s likely a bit of both: 

“The durabletask PyPI token was compromised in May; the same account was used to push the Miasma worm commits in June, which suggests that the credential rotation after the first incident was either incomplete or the attacker retained access through a persistence mechanism that wasn’t caught.”

Still, he notes the systemic risk is more important: “The wider weakness is that PyPI and GitHub’s publishing pipelines still operate on token-based trust with limited behavioral anomaly detection at publication time.” 

Asked for his take, Dwayne McDaniel, Principal Developer Advocate, GitGuardian, agrees that the June attack looks like a continuation of the same campaign from the May incident, though he tells The New Stack clearing that up isn’t necessarily what’s most important for Microsoft right now: “I think their more important disclosure will need to be that we can trust their publishing pipelines and open-source repos again, and that is a real challenge.” 

Is it more than just Microsoft, though? 

When asked what the latest Microsoft incident could mean for the bigger picture of software supply-chain trust systems, David McMillen, Senior Threat Researcher, IBM, tells The New Stack, this attack suggests bad actors are moving on from going after software itself and putting their attention on the trust infrastructure itself: 

“Historically, software supply-chain attacks focused on compromising source code, inserting malware into applications, or breaching software repositories. Today, adversaries increasingly seek to compromise the identities, credentials, build systems, signing services, and provenance mechanisms that determine whether software is considered trustworthy.”

Today, adversaries increasingly seek to compromise the identities, credentials, build systems, signing services, and provenance mechanisms that determine whether software is considered trustworthy.”

So what should developers do now? 

Microsoft hasn’t disclosed the number of affected developers, telling The New Stack simply “we notified a small number of customers who may have pulled down content from the affected repositories” and “we will continue to investigate, and if anything further is identified that requires customer action, we will reach out directly through our established support channels” — the same blurb told to TechCrunch. 

Raj Mallempati, CEO and founder, BlueFlag Security tells The New Stack security teams should prioritize identity governance across the SDLC [software development lifecycle]: “rotate exposed credentials, review OIDC trust relationships, monitor token use for abnormal behavior, pin trusted automation paths where possible, and enforce least privilege on service accounts and machine identities.”

For developers, meanwhile, McDaniel suggests assuming credentials are compromised and replacing them, ASAP. 

YOUTUBE.COM/THENEWSTACK

Tech moves fast, don't miss an episode. Subscribe to our YouTube channel to stream all our podcasts, interviews, demos, and more.

Created with Sketch.