Microsoft's Open Source Tools Compromised in Security Breach

Hackers injected password-stealing malware into Microsoft's open source projects, targeting AI developers.

Microsoft has cut off access to dozens of its open source projects hosted on GitHub as it investigates how hackers apparently breached the projects and injected password-stealing malware into the code. Many of the affected projects relate to Microsoft's cloud service Azure and other tools used by developers to code with AI development apps, such as Claude Code, Gemini's command line interface, and VS Code.

According to security firm Cloudsmith and community-driven malware analysis site OpenSourceMalware, the malware allowed the hackers to steal the users' passwords and other sensitive credentials when they opened the compromised tools in their AI coding apps.

"We've temporarily removed some repositories as we investigated potential malicious content," Microsoft spokesperson Ben Hope told TechCrunch. "Some of these repos have been restored after review, while others may remain offline while work continues."

Microsoft did not immediately provide the specific number of customers affected, when asked by TechCrunch. At least 70 projects belonging to Microsoft have been "disabled," per a message loading when trying to access the projects' pages on GitHub, a code-hosting site that Microsoft owns.

Supply Chain Attacks on the Rise

This is the latest example in recent months of hackers breaching widely popular open source projects with the aim of planting malware on a large number of users who have the code installed on their computers. These hacks are known as "supply chain" attacks as they target code that is often used in a large number of software products, or by a specific kind of user, which may be advantageous to hack as they sometimes have access to cloud systems and large amounts of customers' data.

Microsoft's Second Known Breach

This is Microsoft's second known breach over the past few weeks that has allowed hackers to compromise its open source projects, per Ars Technica. In mid-May, security researchers said that Microsoft's open source project Durable Task, a tool that helps developers build apps, was hacked. OpenSourceMalware said that Microsoft's latest incident is a "re-compromise" of the Durable Task project, suggesting that Microsoft may not have eradicated the hackers on its first attempt or an entirely new, distinct breach.

Implications for AI Developers

The security breach highlights the growing risk of supply chain attacks on widely used open source code. AI developers who use Microsoft's open source tools must be vigilant and take steps to protect their sensitive credentials. Microsoft's investigation is ongoing, and the company has notified a small number of customers who may have pulled down content from the affected repositories.