上周晚些时候，微软的数十个经过加密验证的开源软件包遭到入侵，被植入了高级凭证窃取代码，当开发者在 AI 编程智能体中打开这些软件包时，该代码会被触发。
多位研究人员表示，当 GitHub 上的自动化系统在该平台拦截这些软件包时，共有 73 个软件包被标记为恶意。微软旗下的 GitHub 并未指出这些软件包是恶意的——也未提醒使用 AI 智能体处理这些软件包的开发者应假定其系统已遭入侵——而是表示已禁用这些软件包，“原因是违反了 GitHub 的服务条款”。该文本随后鼓励软件包所有者联系 GitHub。
开发者：假定系统已遭入侵并据此采取行动
直到周一，微软才提出这些软件包可能已被感染的可能性。该公司在一封电子邮件中表示：“我们已暂时移除了一些仓库，以调查潜在的恶意内容。”
这起事件是近两个月内发生的第二起供应链攻击，攻击者侵入了微软的官方仓库账户。今年 5 月中旬，公司 StepSecurity 记录了微软在 PyPI 上的 durabletask Python SDK 遭入侵的事件。该软件包是一个用于构建容错工作流和编排的框架，可自动化分布式事务及其他工作流。其每月下载量达 40 万次。
被入侵的软件包执行了一个 28 KB 的有效载荷，该载荷从 AWS、Azure、GCP、Kubernetes、密码管理器以及超过 90 种开发者工具配置中窃取凭证。随后，它通过云基础设施横向传播，感染其他开发者机器。此次攻击与一个名为 TeamPCP 的威胁行为者有关，攻击者在入侵了用于发布该软件包的微软凭证后，对 durabletask 软件包进行了投毒。该技术使攻击者能够完全绕过仓库的构建流水线。
此次攻击中使用的恶意软件被追踪为 Miasma。它本质上是 TeamPCP 的 Mini Shai-Hulud 工具包的一个克隆版本，该威胁行为者最近将其开源。安全公司 Cloudsmith 表示，该恶意软件会窃取用于 SLSA（软件工件的供应链级别）来源证明的 OIDC（OpenID-Connect）令牌凭证，这是一种为软件完整性提供加密签名保证的方法。
与今年 5 月微软 durabletask 遭入侵的情况一样，上周的攻击也利用了该功能来窃取合法的微软 OIDC 令牌。该恶意软件还被用于另一起独立的供应链攻击，该攻击污染了数十个 Red Hat 软件包。
“Miasma 蠕虫的巧妙之处在于它如何遵循合法的工作流程，”Cloudsmith 表示。“它没有利用 GitHub 或 npm 中的任何软件漏洞。相反，它利用了现代工程生态系统底层信任模型。”该公司继续说道：
被攻破的开发人员凭证导致请求了一个合法的 GitHub OIDC 令牌。随后，一个带有有效 SLSA 来源的恶意构建被发布，最终导致常规扫描器将其视为常规的可信更新。通过窃取合法的维护者凭证，该蠕虫能够完全像一个经过身份验证的发布者那样行事。此外，Miasma 会为每次单独的感染生成一个唯一加密的有效载荷。这意味着传统的基于哈希的入侵指标（IOC）对于广泛检测实际上毫无用处，因为文件签名会随着每个软件包版本而变化。Red Hat 的 Andrew McNamara 在一篇专门的博客文章中解释了 SLSA 的边界在哪里存在不足。虽然之前版本的 Mini Shai-Hulud 恶意软件纯粹专注于本地秘密窃取，但 Miasma 蠕虫似乎拥有专门为 GCP 和 Azure 中的云身份而设计的高级数据收集器。它会尝试收集受感染开发机器和 CI/CD 运行器所能访问到的每一个云身份，这证明了威胁行为者意图利用对代码库的访问权限，直接进入实时云环境。
被攻陷的开发者凭证导致请求了一个合法的 GitHub OIDC token。随后，一个带有有效 SLSA 溯源信息的恶意构建版本被发布，最终使得常规扫描器将其视为一次常规的可信更新。通过窃取合法的维护者凭证，该蠕虫能够完全像一个经过身份验证的发布者那样行事。
此外，Miasma 会为每一次单独的感染生成一个唯一加密的有效载荷。这意味着，基于哈希的传统入侵指标（IOC）对于大规模检测来说实际上毫无用处，因为文件签名会随着每一个软件包版本而改变。红帽公司的 Andrew McNamara 在一篇专门的博客文章中解释了 SLSA 的局限性所在。
虽然之前版本的 Mini Shai-Hulud 恶意软件只专注于本地秘密信息的窃取，但 Miasma 蠕虫似乎拥有专门为 GCP 和 Azure 中的云身份而设计的高级数据收集器。它会试图收集受感染开发者机器和 CI/CD 运行器所能访问到的每一个云身份，这证明了威胁行为者意图利用访问权限，从代码库直接进入活跃的云环境。
感染微软软件包的 Miasma 蠕虫中的凭证窃取功能，会在开发者通过 AI 智能体（包括 Claude Code、Gemini CLI、Cursor 和 VS Code）打开该软件包时立即被触发。后续攻击很可能会发生，因为从那些在受影响的 AI 智能体中打开过该软件包的机器上成功窃取凭证，是极有可能发生的事件。
在五月攻击中被攻陷的那个微软 GitHub 账户，与上周晚些时候被使用的账户是同一个。目前尚不清楚此次双重攻陷的原因。这可能意味着微软未能完全更换该账户的凭证。也可能是某个未知的软件包在微软开发者的机器上运行，窃取了新的凭证。微软目前没有提供更多细节。
恶意软件包的自复制加密验证机制以及绕过基于哈希的检测能力，使得这类攻击难以被发现。而随后同一微软账户再次被攻破的情况表明，此类入侵很难被彻底清除。任何接触过这73个软件包（列表见此处）中任意一个的人，都应立即放下手头工作，展开彻底调查，以防存在任何被泄露的凭证被用于未来的攻击。
Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents.
In all, multiple researchers said, 73 packages were flagged as malicious when automated systems on GitHub blocked them on the platform. Rather than noting they are malicious—and that developers who used AI agents to work with them should assume their systems are compromised—the Microsoft-owned GitHub said it disabled the packages “due to a violation of GitHub’s terms of service.” The text went on to encourage the package owner to contact GitHub.
Devs: Assume compromise and proceed accordingly
It wasn’t until Monday that Microsoft even raised the possibility the packages were infected. In an email, the company stated: “We have temporarily removed some repositories as we investigate potential malicious content.”
The incident is the second supply-chain attack in as many months to breach an official Microsoft repository account. In mid May, the firm StepSecurity documented the compromise of Microsoft’s durabletask Python SDK on PyPI. The package is a framework for building fault-tolerant workflows and orchestrations to automate distributed transactions and other workflows. It receives 400,000 downloads per month.
The compromise packages executed a 28 KB payload that steals credentials from AWS, Azure, GCP, Kubernetes, password managers, and over 90 developer tool configurations. It then spreads laterally through cloud infrastructures to infect other developer machines. The attack, which has been linked to a threat actor tracked as TeamPCP, poisoned the durabletask package after compromising Microsoft credentials for publishing the package. The technique allows attackers to bypass the repository’s build pipeline entirely.
The malware used in the attack is tracked as Miasma. It’s essentially a clone of TeamPCP’s Mini Shai-Hulud toolkit, which the threat actor open-sourced recently. Security firm Cloudsmith said the malware harvests OIDC (OpenID-Connect) token credentials that are used in SLSA (Supply-chain Levels for Software Artifacts) provenance attestation, a method for providing cryptographically signed guarantees of a software’s integrity.
As was the case in the May compromise of Microsoft’s durabletask, the one last week made use of the functionality to steal a legitimate Microsoft OIDC token. It was also used in a separate supply-chain attack poisoning dozens of Red Hat packages.
“The genius of this Miasma worm lies in how it adhered to legitimate workflows,” Cloudsmith said. “It does not exploit any software vulnerability in GitHub or npm. Instead, it exploits the underlying trust model of the modern engineering ecosystem.” The company continued:
Compromised dev creds led to a legitimate GitHub OIDC token being requested. This was followed by a malicious build being published with valid SLSA provenance, which ultimately led to conventional scanners seeing it as a routine trusted update. By stealing legitimate maintainer credentials, the worm was able to act exactly as an authenticated publisher would have. Furthermore, Miasma generates a uniquely encrypted payload for each individual infection. This means traditional hash-based IOCs are functionally useless for broad detection, as the file signature changes with every single package version. Andrew McNamara of Red Hat explained in a dedicated blog post where SLSA’s boundaries fall short. While previous iterations of the Mini Shai-Hulud malware have focused purely on local secret scraping, the Miasma worm appears to have advanced data collectors specifically engineered for cloud identities in GCP and Azure. It attempts to harvest every cloud identity the infected developer machine and CI/CD runners have access to, proving a clear intent from the threat actors to leverage access away from the codebase and directly into live cloud environments.
Compromised dev creds led to a legitimate GitHub OIDC token being requested. This was followed by a malicious build being published with valid SLSA provenance, which ultimately led to conventional scanners seeing it as a routine trusted update. By stealing legitimate maintainer credentials, the worm was able to act exactly as an authenticated publisher would have.
Furthermore, Miasma generates a uniquely encrypted payload for each individual infection. This means traditional hash-based IOCs are functionally useless for broad detection, as the file signature changes with every single package version. Andrew McNamara of Red Hat explained in a dedicated blog post where SLSA’s boundaries fall short.
While previous iterations of the Mini Shai-Hulud malware have focused purely on local secret scraping, the Miasma worm appears to have advanced data collectors specifically engineered for cloud identities in GCP and Azure. It attempts to harvest every cloud identity the infected developer machine and CI/CD runners have access to, proving a clear intent from the threat actors to leverage access away from the codebase and directly into live cloud environments.
The credential-stealing function in the Miasma worm infecting the Microsoft packages was triggered as soon as a developer opened it in AI agents, including Claude Code, Gemini CLI, Cursor, and VS Code. Follow-on attacks are likely to occur in the highly feasible event that credentials were successfully harvested from machines that opened the packages in one of the affected AI agents.
The Microsoft GitHub account compromised in the May attack is the same one used late last week. The explanation for this double compromise isn’t currently known. It may mean that Microsoft failed to fully change credentials for the account. It might also be the result of an unknown package run on a Microsoft developer machine that stole the new credentials. Microsoft isn’t providing details at the moment.
The self-replicating cryptographic verification of the malicious packages and the ability to bypass hash-based detection make the attacks difficult to detect. And as the subsequent compromise of the same Microsoft account shows, these breaches can be hard to fully remediate. Anyone who touched any one of the 73 packages—listed here—should drop whatever else they’re doing and thoroughly investigate, lest there are any compromised credentials that will be used in future attacks.