Microsoft has cut off access to dozens of its open-source projects hosted on GitHub as it investigates how hackers apparently breached the projects and injected password-stealing malware into the code.
Many of the affected projects relate to Microsoft’s cloud service Azure and other tools used by developers to code with AI development apps, such as Claude Code, Gemini’s command line interface, and VS Code.
According to security firm Cloudsmith and community-driven malware analysis site OpenSourceMalware, who were some of the first to flag the hack, the malware allowed the hackers to steal the user’s passwords and other sensitive credentials when they opened the compromised tools in their AI coding apps.
It’s not immediately known how many people have downloaded the affected tools.
Microsoft confirmed it pulled the repos, as first reported by 404 Media. A Microsoft spokesperson acknowledged receipt of our email, but did not immediately comment.
