Microsoft's open source tools were hacked to steal passwords of AI developers

Posted by raffael_de 1 day ago

Comments

Comment by _pdp_ 22 hours ago

What follows next is purely speculation and it is based on my own observations and thoughts but based on what I've seen the old RBAC models, while being almost broken before, now it is fully broken, with the fact that now coding assistants and engineers are working on multiple unrelated projects simultaneously - especially working on wild experiments they had no time for previously. The risk of supply chain issue has increased dramatically in the enterprise.

Again, I am not saying it is related but I think it has an impact.

Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing.

I am not saying it is related but I feel that it coincides perfectly.

I just cannot believe there is no underlaying thread going through all of these recent supply chain issues, and yes there are some hacking groups that specialise in this, sure, but it is because the bounty is plentiful.

Comment by watty 19 hours ago

Just to clarify, and I know you weren't saying they are related, but this has absolutely nothing to do with AI or vibe coding or manager code.

It's a continuation of the Shai Halud worm and the lack of security around developer dependnecy installations, which has existed for a very long time.

Hackers have figured out that developers themselves are an ideal target due to how easy it is to trick them into installing something and how much private information they have on their machines (creds, cloud clis, mcps, etc.).

Comment by josefx 17 hours ago

> due to how easy it is to trick them into installing something

You have tools from large corporations where the official installation procedure involves copy pasting a command from a random blog post, run it with sudo and watch it download and execute a script from a random filehost. This is somehow deemed acceptable by everyone involved.

Meanwhile I can't use teams in our meeting rooms, since any form of internet access was deemed a security risk in rooms where customer projects could be discussed. This is in a day and age where 90% of customer meetings are done over the internet.

Anyone trying to follow sane practices in this industry just asks to end up in a padded cell.

Comment by dessimus 9 hours ago

> Meanwhile I can't use teams in our meeting rooms, since any form of internet access was deemed a security risk in rooms where customer projects could be discussed. This is in a day and age where 90% of customer meetings are done over the internet.

I hope this is in jest. Are you saying in order to discuss any customer project you have to book a meeting room? So no discussions of customer projects at the open plan desks or even in your boss' office for fear that something might overhear that conversation? Or is this only when the customer happens to be on-site to discuss their project? Does your organization assign U.S. Military style NICKA code names to everything?

Comment by dirkc 12 hours ago

> This is somehow deemed acceptable by everyone involved

By some, not all. It's been crazy from the start and it is still crazy to pipe a script to bash!

Comment by chickensong 12 hours ago

> Anyone trying to follow sane practices in this industry just asks to end up in a padded cell.

Same as it ever was.

Comment by madeofpalk 18 hours ago

As with many other things, AI exacerbates this problem. It’s so easy for many more of things things to happen unattended and in greater volume, and the AIs themselves can be tricked into doing these things, not helped by their patten of “prompt the user to approve 30 different inscrutable pythons and bash scripts”.

Comment by wolvoleo 18 hours ago

> Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing.

Yes in our place too. "You better do as much as possible with AI or you will be left behind" dogmas etc.

It's the stupid IoT hype all over again. No concern for security, just trying to be the first in the pack.

Comment by renegade-otter 18 hours ago

"MongoDB is the hottest thing! No default creds, who cares about that! ONWARD TO PRODUCTION, SOLDIERS!"

Comment by thewebguyd 11 hours ago

MongoDB is web scale.

Comment by doubled112 17 hours ago

Instead of learning from past mistakes, it seems we need to keep making the same ones over and over.

Comment by wolvoleo 17 hours ago

It has all happened before and it will all happen again :)

Comment by dylan604 14 hours ago

I just finished watching that series, so I can pick up these references. Nothing like being 20 years late to the party

Comment by wolvoleo 10 hours ago

Has it been 20 years already? Wow. Yeah it was a good one (though a little too gritty for me sometimes)

Comment by abustamam 9 hours ago

Apparently I'm late to the party too! What is this from?

Comment by wolvoleo 6 hours ago

Battlestar Galactica remake

Comment by gowld 9 hours ago

Peter Pan came out in 1953

https://www.reddit.com/r/BSG/comments/12e31w3/so_i_was_today...

Comment by bingo-bongo 15 hours ago

..and with faster and faster iterations :|

Comment by ndsipa_pomu 16 hours ago

Time is a flat circle

Comment by sadlfkhgj 12 hours ago

Time is a cube.

https://en.wikipedia.org/wiki/Time_Cube

Comment by altairprime 22 hours ago

I argued for years that we had too few workers for our total project count and management argued that most projects were idle and so it was fine to have so many per worker.

Welp.

Comment by _pdp_ 22 hours ago

I think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution because at the very least you can get an isolated dev environment per project. I've been advocating for this for as long as I remember.

Unfortunately, most developers don't like them so it is a though sell.

Comment by 63stack 20 hours ago

Why do most developers not like it? Is it because the browser is a terrible platform for text editors since there is no proper key mapping, or access to proper debuggers, or there is too much latency, and no access to cli tools?

You make it sound like you are surprised, but everyone who has tried this knows it's crap and a band aid at best.

Comment by nosioptar 19 hours ago

I really tried to give vscode an honest shot.

I couldn't find anything about it that was even half as good as a real text editor.

It made writing code feel like a chore. I usually love writing code.

Comment by GabeIsko 12 hours ago

What is a real text editor, by your estimation? NVim? Emacs? Genuinely curious.

I use VSCode/Codium since I maintain a GUI stack for general usage. But I have all the terminal tools installed for my work there as well. I hate customizing things too, which I find is necessary if you want to get the most out of terminal text editors. VSCode is pretty good out of the box, with terminal access and everything built in.

Jeez, I hope this doesn't turn into a text editor flame war...

Comment by greggroth 20 hours ago

I hope folks know they can use Codespaces in their desktop editor. I never use the web editor.

Comment by fc417fc802 19 hours ago

Why would I ever want to use a browser based solution instead of local VMs? If you're worried about VM escapes then you have bigger problems (and hopefully a full time security team supporting you).

Edit: I realize in hindsight this comes across as overly negative. I think those are great solutions to have available for when you are working with a suboptimal local setup for whatever reason. I just don't think they're the default choice let alone any sort of ideal to strive for.

Comment by domh 21 hours ago

Web-based IDEs like VSCode on github just had a 1-click github token stealing vulnerability: https://blog.ammaraskar.com/github-token-stealing/

You could argue this is probably on GitHub for creating a token here that gives blanket access to all repos vs a scoped token for just the repo.

Comment by altairprime 21 hours ago

Is the theory here that the browser cannot be co-opted to infect web-based repositories? Also: thinking of how yt-dlp can integrate with browser cookies now and the malware paths that opens up. (This is part of why Chrome wants HSM cookies, I expect: DRM and opsec!)

Comment by _pdp_ 21 hours ago

In this scenario the malware will not be on the device but in an isolated dev environment on a remote machine. So it will have access to whatever was configured in that repo but hopefully the project is isolated enough to ensure containment and prevent cross-pollination.

Comment by repelsteeltje 20 hours ago

I don't think the cloud (someone else's computer) is the best solution. The sanitation problem can be mitigated by compartimentization but the cloud aspect also adds brittleness and new attack vectors.

Why not set up proper containers (or VMs) locally? And why not wait a little till local LLMs catch up?

Maybe just a personal itch, but having your dev environment elsewhere feels so gross to me..

Comment by _pdp_ 17 hours ago

That is the problem. You outline perfectly how a developer sees the situation.

On the other hand ephemeral cloud environment with proper security controls makes a lot of sense if the goal is to isolate and control.

If everyone was following the protocol we wouldn't have had the problem to begin with.

Comment by altairprime 20 hours ago

That’s a big, labor-expensive if.

Comment by jasonjayr 19 hours ago

This is the leg of the cycle when we go back to mainframes & centralized computing? With all the datacenter build out; why wouldn't you want your services adjacent to the LLM processing centers?

Comment by matkoniecz 17 hours ago

> I think web-based IDEs like GitHub Codespaces (but even VSCode with tunnels) is part of the solution

I am against proprietary SAAS online in browser dependencies.

Comment by black_knight 22 hours ago

Do you mean that role based access control (RBAC) should be replaced by something else? Or that just the specific RBAC models in use are broken?

I personally think the, perhaps confusingly named, capability based security models are the way of The Future.

Comment by rswail 16 hours ago

ABAC/Capability and very granular policies for both actions and actions on behalf of others with the right sort of resource-based policies as well. And the apps need to be capability constrained and sandboxed.

Gonna be a hard nut to crack to implement this across the supply chain.

Transitive dependencies are a bitch.

Comment by wartywhoa23 20 hours ago

> Now in many places it is encouraged by coders and managers to vibe stuff on their own devices. Soon or later it will become a problem, especially for those that have no idea what they are doing.

Idiots must suffer.

Comment by sourcecodeplz 22 hours ago

one could also vibe-code vanilla, no dependencies.

Comment by _pdp_ 22 hours ago

You can vibe code safely for sure.

I am not saying vibe coding is the issue. The issue is that a typical developer might be working on a lot more projects that run concurrently then they used to. And because of the various nature of the project the risk is significantly increased.

Scale this across the workforce and you not just doubled the problem.

Comment by Grimburger 20 hours ago

You can vibecode docs and tests also but I'm truly not seeing more of those.

In the end it can just be a culture thing. A dev who was going to write docs and tests before is going to have a LLM generate docs and tests today. Same with safe practices and defensive coding. The machine does whatever you want from it, for most that's "just get the job done I don't care". So that's the output.

Comment by johnisgood 18 hours ago

If I vibe code a project, that involves docs and tests as well. Obviously I do not, at any point, do anything blindly and there are some iterations for everything. I always double-check, and I do not use "agents", I do everything manually. I always check what the LLM is thinking, in real-time. I might be old school, but that allows me to write code that is not a pile of shit. :P I am still conscious about quality.

Comment by whattheheckheck 14 hours ago

Anecdotal.

13 million swe roles with .01% is 130,000 compromised devices.

Process problem

Comment by johnisgood 11 hours ago

I think that the numerical example you gave appears to be wrong unless you intended 1% rather than 0.01%.

In any case, fair enough. The concern is that organizations will build processes around AI where many people do not review outputs carefully. I do not disagree with this.

I also agree that my particular workflow is anecdotal and does not work at scale.

Comment by whattheheckheck 4 hours ago

Yes my bad I even checked it in the calculator but then typed in .01 again but added % again. I meant to do it to serve as an example of how bad humans are at thing.... right...

Yes 1%

Comment by johnisgood 8 minutes ago

I do agree.

Comment by xeonmc 12 hours ago

"Practice safe vibecoding, stop the cycle of infections!"

Comment by vasco 18 hours ago

You can also fork everything and maintain local versions that you much more easily resolve conflicts with upstream with AI and get the best of both worlds while you work through the backlog of internally reimplementing all dependencies, which even with AI will take a long time.

Comment by bilekas 22 hours ago

The phrasing of the title is loaded and the content phrases it as some kind of fault of open source.

Then, which I find the most amusing, proceeds to blame MicroSlop for the attempted suuply chain attack,

> Microsoft did not immediately provide the specific number of customers affected, when asked by TechCrunch.

Yeah, because that's how open source works. Tech crunch doing hard work no not explain that.

> This is Microsoft’s second known breach over the past few weeks that has allowed hackers to compromise its open source projects, per Ars Technica.

I, like many others love to knock on Microslop when I can, but in this case they did the right thing. The article phrases it like they did everything wrong, they're all at fault and shame on them for limiting the breach.

This is not the first time I've seen an article from Zack Whittaker that just rubbed me the wrong way.

> steal passwords of AI developers

This phrasing has it's own connotations. AI developers versus developers who use AI?

> This is the latest example in recent months of hackers breaching widely popular open source projects with the aim of planting malware on a large number of users who have the code installed on their computers. These hacks are known as “supply chain” attacks as they target code that is often used in a large number of software products, or by a specific kind of user, which may be advantageous to hack as they sometimes have access to cloud systems and large amounts of customers’ data.

Describes literally nothing of what a supply chain attack is, just the result of one and the reasons for their attack surface.

Very very bad reporting in my opinion. Bad breach, and I hate to admit M$ did the safe and right thing, but this 'reporting' leaves a lot to be desired.

Comment by mattfields 5 hours ago

That's the thing: they do bear responsibility in allowing the situation to get to this point and are very pointedly not connecting the dots with their response.

Microsoft which owns GitHub, has been washing their hands if any responsibility in helping to resolve the ongoing supply chain catastrophe which is hosted and spread nearly entirely via Github repositories: not responding to security researchers flagging malware hosted on GitHub; doing nothing to address the proliferation of open source malware across their platform, giving no recourse for action, not applying their tremendous resources to the problem, fiddling as the open source community burns and leaving the devs to fend for themselves. Let's not mention the recent very hostile and trust-erodibg behavior towards bug bounty security researchers.

The *&$@ finally spread all the way up to the top of the hill in a compromise of Microsoft's own repos, which I think highlights the scale of the problem.

And in response, they offer a watery corporate platitude, "a few customers were affected in a recent incident, and we're looking into it."

Comment by cookiengineer 1 hour ago

Microsoft's introduction of 2 hour latencies for vscode extension installations to mitigate the ongoing worm spread is absolutely bonkers.

They did not read the source code of the worm implant and have absolutely no clue how the worm works, if that is their response.

The only way to meaningfully stop the worm is by requiring manual confirmations for git commit/push actions and for the auto-executed hooks in all IDEs. Also, these scripts should be sandboxed to only be allowed to run and interact with files inside the same opened project folder.

Well, that, or setting the host system language to Russian. Which I am kind of expecting Microsoft to do next...

Comment by dgellow 22 hours ago

TechCrunch is very sloppy and unreliable. I’ve seen them reporting on things I worked on where they just invented facts for SEO purpose and there is no way to get them to correct

Comment by sourcegrift 20 hours ago

Which is worse tc or verge? Verge does similar making up of facts.

Comment by subscribed 19 hours ago

Similar. They both don't belong here.

Comment by philipwhiuk 22 hours ago

> > This is Microsoft’s second known breach over the past few weeks that has allowed hackers to compromise its open source projects, per Ars Technica.

> I, like many others love to knock on Microslop when I can, but in this case they did the right thing.

I've no idea what your problem with this sentence is. They have an organisational security problem, aided/demonstrated by lack of effort to effectively lockdown GitHub Actions and allowing MRs to circumvent CI/CD.

That this is a Microsoft problem that was present pre-AI is not up for debate. See https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewO...

In the age of AI, it's now endemic and being weaponised.

Comment by bilekas 21 hours ago

> That this is a Microsoft problem that was present pre-AI is not up for debate. See https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewO...

No argument from me, but what would you have them do in the immediate timeframe ?

Comment by philipwhiuk 18 hours ago

Some form of public communication from Microsoft Security indicating an actual threat to their ecosystem and published pipeline of work to reduce the ability of attacks to spread via GitHub actions.

They can publish self-congratulatory stuff like this: https://www.microsoft.com/en-us/security/blog/2026/06/05/sec... but they can't publish a post-mortem on their own platform?

I'm told that when Affirmed got compromised Microsoft Security descended on the org and rewrote their entire backlog. Where is the plan from GitHub that they are now taking security seriously given GitHub Actions is now a primary threat vector even for projects written by their own company.

Comment by raffael_de 22 hours ago

What's your post mortem, then? As in - what happened and how should it be read?

Comment by bilekas 22 hours ago

Microsoft's open source projects the target of a supply chain attack and they decided to restrict access to understand and limit exposure ? Something a little more 'true' and less targetted?

Comment by philipwhiuk 22 hours ago

Azure are able to be targets of supply chain attack because of the supply chain ecosystem that they still own. It's not really a supply chain when it's still yours.

Comment by bilekas 21 hours ago

> It's not really a supply chain when it's still yours.

I don't personally buy that, they offer a package manager in the form of nuget for example, if their products there are compromised, they're well withing normal reach to block THEIR packages, but why would they need to block the rest ?

Maybe I'm missing something dumb

Comment by philipwhiuk 18 hours ago

* GitHub [which they own] failed to detect the account was compromised

* GitHub [which they own] allowed the contribution to ignore CI

* GitHub [which they own] failed to detect suspicious content on check-in

* GitHub [which they own] isn't sufficiently integrated into Microsoft security that the compromised token wasn't rolled.

Comment by raffael_de 20 hours ago

[dead]

Comment by JdeBP 23 hours ago

These seem related:

* https://news.ycombinator.com/item?id=48418318 (The Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds)

* https://news.ycombinator.com/item?id=48450543 (Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents)

* https://news.ycombinator.com/item?id=48416155

* https://news.ycombinator.com/item?id=48416269 (Miasma Worm Targets AI Coding Agents via GitHub Repos)

Comment by mattfields 5 hours ago

Yep. This is the thing that Microsoft is not mentioning in their watery response there.

Comment by cookiengineer 18 hours ago

I created a mitigation tool that can be used to fix/remove the worm from all infected repositories, and did a writeup about this.

On Monday, the Hades campaign introduced Composer, Go and Pip support. Before that it had only support for NPM and AI assistant editors. (Well, and Ruby btw but nobody uses Rubygems anymore it seems).

What even Microsoft gets wrong: This is the first worm that runs on all platforms in the code ecosystem. Developer host machines, servers, ci/cd runners. And all of them spread the worm to all repositories that are accessible on those machines.

You would have to completely shutdown 100% of all computers AND aws ec2 AND google cloud platform AND azure AND kubernetes clusters AT THE SAME TIME to beat this worm. It literally spreads across all infrastructure.

Kill switch, as always with APT28 malware, is setting the host language to ru_RU.KOI8-R (LANG environment variable). That disables the spread mechanism.

My Mitigation Tool (I'm updating it as new package systems are targeted ...):

https://github.com/cookiengineer/antimiasma

Blog post:

https://cookie.engineer/weblog/articles/malware-insights-mia...

Comment by philipwhiuk 18 hours ago

It only spreads if you run the code...

Comment by cookiengineer 12 hours ago

No, it spreads if you open a folder. That's the point why developers all underestimate the worm's capabilities.

Comment by mattfields 6 hours ago

This ^

Comment by bob1029 22 hours ago

I strongly suspect this is a case of classic personal access tokens being used in an unclean way.

If you are going to be handing tokens to AI agents on weird openclaw contraptions, you should try to use the fine grained variants. My GitHub account spans 3 organizations with wildly differing policies. The fact that classic tokens are even still allowed blows my mind a bit. You should be required to manually opt in each organization at a minimum.

Comment by red_admiral 20 hours ago

It feels to me like AI agents should be their own security principals and use access tokens generated speficically for them on the repos or orgs that they need access to. Handing an AI agent an access token "minted" for a human's account feels to me like the new "write the password on a post-it".

Comment by silon42 20 hours ago

Not just AI agents... basically, if you cd Projects/foo, that should be it's own user (for running npm, etc) that should not have access to parent user data (probably including github tokens, etc).

Comment by matheusmoreira 12 hours ago

> basically, if you cd Projects/foo, that should be it's own user

Agreed. I went further and turned that into its own isolated virtual machine. The credentials problem is really annoying though. AI agents need the access in order to be useful.

Comment by IX-103 19 hours ago

Why not both?

Comment by Klathmon 19 hours ago

This is what I'm advocating for.

Give each dev's AI agent its own identity with its own access controls and tokens and everything.

It helps solve both the access control and attribution issues

Comment by notnaut 20 hours ago

As long as there’s a way to deterministically tie a model call to a human user. I think a loss of culpability is something some companies are afraid of to some extent.

Comment by etiennebausson 20 hours ago

Loss of liability is what company are built for, see the meaning of LLC as an exemple.

Of course, it is only their employees that are impacted instead of their bottom line, they might be more tolerant?

Comment by test20201 22 hours ago

You are correct but the issue is permission management with finegrained tokens is nighmare. It is not easy to decide what is correct and what is needed for some operation. Furthermore, often software devs think it is important to focus on code rather than permissions - as it is for someone else's responsibility....

Comment by jerf 18 hours ago

Sometimes the basic things missing in the programming world just shock me. How is anyone supposed to know what permissions to give in these systems that have literally hundreds of fine-grained permissions, many of which can also have scope? Even if they're "documented" we all know from experience that some textual descriptions of a permissions won't capture when it is actually used in the code.

Why isn't it standard to have a security log that shows what permissions were requested, with what scope, so we can at least create a minimal set of permissions by trying an operation, seeing what permissions are necessary, and then setting just the needed permissions? If you're worried about that log itself becoming a compromise, make it something that is off by default, and maybe automatically turns off after some period of time, or make me use a burner token for this operation, or something, but the alternative is the world of excessively-broad permissions that we live in now. Why isn't there a helper mode that a dev can use to point at an interaction and say "now give me minimal permissions for those interactions", not only to configure a given key but so we can learn what permissions actually mean in practice?

We're given these super complicated knobs, but all we get for using them is a few textual blurbs about the settings and the blame if we don't configure them exactly correctly, and also the blame if something breaks because we were too tight with the permissions.

This seems such a basic tool to use these super complicated systems yet I've never seen them anywhere on the web.

Perhaps ironically, perhaps just because it was already complicated enough and needed a way to approach usable, the notoriously difficult to use SELinux uses this as the more-or-less standard way of setting permissions. I can't believe I'm missing SELinux.

Comment by lmc 14 hours ago

If classic PATs were to blame, doesn't this mean further private repos could be at risk as well? (apart from the GitHub ones the other day).

Comment by trumpdong 21 hours ago

I use classic tokens on low-privileged accounts for scraping public repos. I suppose organization level permissions would work fine for me.

Comment by haute_cuisine 21 hours ago

Please, someone explain how it's possible to add obfuscated file to so many repositories? Do they don't have any code reviews?

Also, the title is misleading, setup adds config to be auto executed by people who work on the repo. They would have to use vscode/cursor/claude/gemini. People who use codex / opencode / other harnesses are safe I guess.

Details: https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-...

Comment by axegon_ 21 hours ago

> Do they don't have any code reviews?

I have a good friend that works for one of the giants(I can't say which one for obvious reasons but S&P 500). He's been working there for quite a while now, so far he hasn't seen what the project he works on looks like, has the repo cloned and knows what language is used but nothing beyond that. Everything is slopped together. His project is the authentication and authorization system for all the company products. In his own words "I hit Tab all day long and write 'this is intended' in the reviews, which are all ai, there is no human in the loop. This is what we are told to do by the CEO and CTO unironically. If something breaks, no one knows how any of this works since no one has seen the actual code. Our performance reviews are based on how many tokens we've used, not what we have done". I suspect this is the case in many companies now so it's not unreasonable to think that there are no actual code reviews.

Comment by 349187 18 hours ago

Maybe the company or the CEO are invested in AI companies. Half of this tokenmaxxing is ordered by legitimately insane people, the other half has vested interests.

When that boost disappears after the IPOs, everything will crash.

Comment by axegon_ 17 hours ago

> When that boost disappears after the IPOs, everything will crash.

Don't threaten me with a good time(also unironically).

Comment by LastTrain 20 hours ago

> have a good friend that works for one of the giants(I can't say which one for obvious reasons but S&P 500).

I can’t think of any obvious reason other than this being embellished / made up? Those companies have tens of thousands of employees you aren’t going to “out” anyone by naming the company.

Comment by axegon_ 19 hours ago

I have a fair share of OSINT experience, be it as a hobby. The fact that I said S&P 500 and what his department does, that he is hired as a developer, I've already narrowed it down to several thousand people. Add the company name and you can narrow it down to a few dozens at most. And you can keep deducing further till you narrow it down to one or two.

Comment by romaniv 8 hours ago

First, it's not made up. I've heard numerous stories of this sort (maybe a bit less extreme) from people I have known for many years working for large and mid-sized companies. Second, large companies have entire teams for monitoring social media and they absolutely will try to zero in on you and fire you if you speak too much about their crappy internal processes. This goes double for anything in S&P 500.

Comment by trumpdong 21 hours ago

the reasons are not obvious. I want to avoid their products.Does anyone else *cough* who has a throwaway account know the place?

Comment by axegon_ 21 hours ago

At this point, I suspect that is just about every tech company. Your best bet is to self-host everything, no agents, no cloud services, completely locked up home network and a loaded shotgun if anything starts making unexpected noises.

Comment by Tangurena2 18 hours ago

Many of the malicious commits show as an author `github-actions <github-actions@github.com>`. Which means that they are authenticating as internal github CI/CD stuff and that there are so many of those that no possible automated tool can find the poison in the mountain of chaff.

So this is related to the Sept 2025 security breach of Github.

> The five repos carry 1,459 GitHub stars between them, mantine-datatable alone accounting for 1,225. Stars are a rough proxy for how many developers have the source checked out locally, which is the population this attack targets.

> Every commit: unsigned, github-actions identity, chore: update dependencies [skip ci], the same six-file footprint. A 49-second sweep across five repos is automation, not a human committing. This matches Shai-Hulud self-propagation: harvest a GitHub token with write access from a prior infection, then push the persistence payload into every repo the token can reach.

https://safedep.io/miasma-worm-ai-coding-agent-config-inject...

What it is doing: https://safedep.io/config-files-that-run-code/

I'm not related to those guys. That's the simplest detailed explanation of what is happening that I've found.

Comment by ianmarcinkowski 19 hours ago

Coworker seriously asked "since we're generating most of our code now, who is actually reading all of the code?" We're at a small company, but the urge to trust The Oracle is almost spiritual with some people IMHO.

I read 90%+ of the code I generate by reviewing it like I would a junior developer. I'm heavily vibe-coding a new feature right now and it's going to get a thorough reading as soon as GitHub's PRs start working again

Comment by vorticalbox 21 hours ago

if an account with the ability to push to the repo was taken over, there wouldn't be any PR review.

Comment by protoman3000 23 hours ago

And we trust these people with the root CA cert in our Secure Boot?

Comment by shakna 22 hours ago

You mean the company that failed their 2023 security review? [0]

> Individually, any one of the failings described above might be understandable. Taken together, they point to a failure of Microsoft’s organizational controls and governance, and of its corporate culture around security.

Microsoft’s products and services are ubiquitous. It is one of the most important technology companies in the world, if not the most important. This position brings with it utmost and global responsibilities. It requires a security-focused corporate culture of accountability, which starts with the CEO, to ensure that financial or other go-to-market factors do not undermine cybersecurity and the protection of Microsoft’s customers.

> Unfortunately, throughout this review, the Board identified a series of operational and strategic decisions that collectively point to a corporate culture in Microsoft that deprioritized both enterprise security investments and rigorous risk management. These decisions resulted in significant costs and harm for Microsoft customers around the world.

> The Board is convinced that Microsoft should address its security culture.

[0] https://www.cisa.gov/resources-tools/resources/CSRB-Review-S...

Comment by magicalhippo 18 hours ago

Guess that's what lead to the Secure Future Initiative[1], given it was launched late 2023[2]...

[1]: https://www.microsoft.com/en-us/trust-center/security/secure...

[2]: https://cybermagazine.com/articles/how-microsoft-is-securing...

Comment by stogot 18 hours ago

Bonkers that this wasn’t bigger news

Comment by ZeroWidthJoiner 20 hours ago

The root of trust in Secure Boot is typically an OEM certificate, not Microsoft's, which is probably even worse: https://www.binarly.io/blog/pkfail-untrusted-platform-keys-u...

In any case, you're free to remove Microsoft's certificates and enroll your own.

Comment by justinclift 22 hours ago

More like "forced to accept" rather than "trust".

This latest event just continues Microsoft's track record of being a security problem rather than having their shit together. :(

Comment by sunaookami 21 hours ago

No one should be foolish enough to trust Microsoft with anything regarding security. They showed time and time again over the past 40 years that they don't care.

Comment by trumpdong 21 hours ago

Have you bought a PC in the last 10 years? Then it came with Microsoft's secure boot keys on it. Sometimes it's not even possible to remove or disable them. Sometimes you actually need a Microsoft-signed bootloader shim to boot anything that isn't Microsoft.

Comment by sunaookami 19 hours ago

I haven't bought a Windows PC in the last 10 years, yes. I think the last Windows PC I bought was a used ThinkPad from 2011 that I upgraded and used until 2022.

Comment by AdamN 21 hours ago

What do you mean 'we'? :-)

Comment by 23 hours ago

Comment by yoyohello13 17 hours ago

I had to reset my personal Microsoft account password yesterday because I got a two factor alert about a log in attempt from Romania. I can’t figure out how they got my password though because the only Microsoft product I own is an Xbox. Even before ai though Microsoft leaks like a sieve. I wish my company would move off them, but we are locked in.

Comment by rspijker 16 hours ago

It is almost impossible to set up personal Microsoft accounts that does not allow passwordless login. So what is more likely to have happened is that your account is set up like this and you are just getting MFA requests that are not a second factor, but simply an attempt to get access to your account.

I was getting multiple of these a day and found that if you set up the Microsoft Authenticator app from a phone, it will force it to passwordless if you have any type of lock on your phone (facial, fingerprint, pin). The only way around it is to disable all of those while setting up the account in the authenticator app. I don't use my Microsoft account much, so just use a separate e-mail now for verification instead of the authenticator app.

The fact that this is how it works is of course insane, but I'm guessing someone inside of Microsoft is hitting their KPIs for passwordless logins or something...

Comment by yoyohello13 16 hours ago

Thank you! I have a very strong password so I was worried about how this could happen, but your scenario makes sense. Especially since it only seems to be my Microsoft account having this problem.

Comment by skinfaxi 15 hours ago

In some organizations I've worked at, the multi-factor prompt would occur regardless of the password validity (wastes more of the attacker's time). Is that the case with Microsoft? I'm not sure.

Comment by ashishb 21 hours ago

Nobody should do 'npm install' or 'pip install' on their machine.

Using a proper sandboxing(https://github.com/ashishb/amazing-sandbox) regularly will drastically limit the blast radius of these attacks.

Comment by pritambaral 21 hours ago

> https://github.com/ashishb/amazing-sandbox

Does your Docker backend run commands in rootless containers? I skimmed the code but didn't see anything to confirm this.

Comment by ashishb 16 hours ago

Right now, not. Eventually, they will.

You can pass your favorite rootless Docker image using `--custom-docker-image` CLI parameter.

Comment by Bnjoroge 19 hours ago

Docker isn’t a serious sandboxing strategy

Comment by ashishb 16 hours ago

This has been responded to in the past by another HN poster: https://news.ycombinator.com/item?id=47612726

Furthermore, you can use native sandboxing on macOS if you prefer.

If neither looks serious to you, then please educate me on a better sandboxing approach.

Comment by graemep 21 hours ago

> Nobody should do 'npm install' or 'pip install' on their machine.

What alternative do you suggest?

Do you mean not install outside a sandbox?

Comment by mr_mitm 17 hours ago

I've been playing around with declarative container configurations: https://github.com/AdrianVollmer/ContainerConductor (It's not ready, don't use it!)

It will always introduce friction, though.

Modern software development is simply too fast to be reviewed properly.

Comment by progx 20 hours ago

alias npm / bun / ... to run in a docker container, so npm install run automatically in the container.

Comment by ashishb 16 hours ago

That's exactly what I started with. It gets unwieldy quickly enough as you need to mount a lot of directories that these you uses as cache.

So, amazing-sandbox at its core is nothing but a glorified docker command generator (in default mode).

Comment by themafia 21 hours ago

Download source. Extract. Move files to correct node_modules folder.

If your distribution requires more than this, then it's not really a module, or combines too many non-modular components, and should be distributed differently.

The ability for npm to run scripts on any level should be removed.

Then we can go back to worrying about namespacing issues.

Comment by ashishb 16 hours ago

> The ability for npm to run scripts on any level should be removed.

Even Python has that ability now. Also, `npm run dev` is running the script with full disk access.

Heck, Vscode/Cursor will auto-execute code if you open a project. And this has been actively used in the wild https://ashishb.net/security/contagious-interview/

Comment by 63stack 20 hours ago

You discovered what web development was like in early 2000.

Comment by dist-epoch 21 hours ago

If an attacker can infect the post-install script of an npm package, they can also infect the package source code itself. So if you ever run the project outside the sandbox, you will still get compromised.

It's like saying "I don't trust a software app with an installer, I just want a .zip with the binaries from the same source that I will run myself"

Comment by themafia 21 hours ago

> they can also infect the package source code itself

Which is where the concept of "safe levels" come in. I should be able to install this module in such a way where file operations and process operations are not available to it. That being said, presumably, this types of infiltration would seem to be _much_ easier to spot. "Why is this web framework calling 'spawn'?"

> I just want a .zip with the binaries

I want a .zip with the _code_. Just the code. None of the packaging nonsense. My distribution can handle that.

Comment by ashishb 16 hours ago

> I should be able to install this module in such a way where file operations and process operations are not available to it.

That's the definition of a sandbox, isn't it?

Comment by dist-epoch 20 hours ago

do you really think you will see a clear "spawn" call? there is a long history of obfuscating what the code does to hide backdoors, in quite ingenious ways

> I should be able to install this module in such a way where file operations and process operations are not available to i

technically browser sandboxes, WASM, do this. but then you are very limited since you can only sandbox the whole app, and not one module, so if you need local file access, you need to open it up to the whole app and all it's modules

Comment by 8organicbits 19 hours ago

Is there a detection component here too? Sandboxing development is great, but the next step is to deploy to production. How do you know if something malicious happened in the sandbox, such that you don't deploy the malware further?

Comment by ashishb 16 hours ago

I have some ideas around it. And indeed that's one likely direction of this project in the future.

Comment by 21 hours ago

Comment by giancarlostoro 16 hours ago

I was probably late to the party in realizing and saying it, but I've been saying for a little while, even if you don't want to use AI because "the code is bad" or whatever, I highly suggest you consider having AI auditing code and services for security, or literally anything that scans code for vulnerabilities.

The attack vector isn't just plugins that steal your data, but also 0-day exploits in just about any software you use, and even your own web services being exploited by a script kiddy with an LLM. There will be an increase in hacks and it's only going to get worse, so anyone not investing in cyber security audits and auditing tools should really reconsider.

Comment by yifanl 16 hours ago

AI harnesses were exploited, here's why it's actually good for AI.

Comment by giancarlostoro 16 hours ago

Not what I'm saying at all, but okay. More like "don't sleep on cyber security" more than anything. I don't care if you use AI, though it can definitely be useful for security auditing. Red teams are going to become more invaluable these days.

Comment by yifanl 16 hours ago

You're talking about living in a world where we have to take entirely preventative steps, not reactive because hacking is going to be that much more prevalent.

AI can tell you you're being zero-day'd, but that isn't much comfort - you're already expecting everyone to always be zero-day'd at all times!

Comment by giancarlostoro 15 hours ago

What I'm suggesting is that AI and security tooling can help you minimize attack vectors.

Comment by 11 hours ago

Comment by romaniv 15 hours ago

You can post any number of snarky booster comments, but at the end of the day they are the opposite of insightful. They are an obfuscation.

What I'm seeing is that the whole security model built around endless code re-evaluation and continuous (usually online) updates is collapsing in a spectacular fashion. This is not "good for red teams" or "good for security AI". This is not good for anyone except malicious actors.

I rarely do these, but here is my prediction: doing more of the same but faster is not going to work. No matter how much AI compute people will throw at security scans and patching, the number of security incidents and the overall instability will keep going up until the underlying security model is fundamentally changed.

Comment by giancarlostoro 15 hours ago

Booster comments? What? Since when is routine security auditing bad? A lot of people sleep on it, and have insanely obvious (in hindsight) security issues that could have been avoided by a simple audit.

Comment by zihotki 22 hours ago

And the best recommendation security teams can give - keep your SBOM strict, use min release age policy (sounds more like band-aid). That's a scary world to live in.

Comment by wolfi1 22 hours ago

a friend of mine has a very different solution: he codes everything by hand. he says that the time you need to research to include a new package you can actually use to code the piece you need. and he for sure doesn't have the problems of transitive dependencies

Comment by supernes 20 hours ago

That's been happening to me more often too recently. I find that, for a growing number of simple problems, reinventing the wheel is faster and more efficient than importing a mature, fully-featured dependency.

Comment by nicce 22 hours ago

Depending of the scenario, it can be very fine. E.g. if you just need one or two function call from the dependency. However, for some complex binary protocols it might be better to stick with libraries.

Comment by dgellow 22 hours ago

I assume that means he genAIs all his deps? Rather than writing by hand

Comment by wolfi1 17 hours ago

he does not use them

Comment by hsbauauvhabzb 21 hours ago

But now he needs to develop, test and maintain that code. Left pad is easily hand coded, react framework not so much.

Comment by wolfi1 21 hours ago

his projects were GUIs for machines (HMI)

Comment by rcxdude 14 hours ago

Embedded software already has a pretty strong culture of rarely using libraries and vendoring them if they do (for better and for worse). This kind of worm just doesn't really make sense in that kind of environment anyway.

Comment by hsbauauvhabzb 17 hours ago

That’s not really my point. My point is some libraries are easily replaced and others are massive, complex and need ongoing support.

By the same logic, he could avoid system dependencies by writing his own OS. But it obviously doesn’t scale.

I’m all for an anti-library ethos, as long as the pros and cons are carefully considered and wheels are only reinvented when the cost/risk ratio is right.

Comment by nicce 22 hours ago

> keep your SBOM strict

Based on the news, seems like it is better to not include Microsoft at all in there.

Comment by minraws 23 hours ago

Remember folks Microsoft has Mythos access

Comment by xeyownt 13 hours ago

No, it's Mythos that has access to Microsoft now :-)

Comment by 22 hours ago

Comment by axus 23 hours ago

Their source has the list of the 73 disabled repositories: https://opensourcemalware.com/blog/miasma-reaches-azure

Comment by antiloper 23 hours ago

AI;DR:

Azure (49)

azure-functions-agents-runtime azure-functions-connector-extension azure-functions-core-tools azure-functions-docker azure-functions-dotnet-extensions azure-functions-dotnet-worker azure-functions-durable-extension azure-functions-durable-js azure-functions-durable-powershell azure-functions-durable-python azure-functions-extension-bundles azure-functions-golang-worker azure-functions-host azure-functions-java-library azure-functions-java-worker azure-functions-kafka-extension azure-functions-language-worker-protobuf azure-functions-mcp-extension azure-functions-nodejs-e2e-tests azure-functions-nodejs-library azure-functions-nodejs-opentelemetry azure-functions-nodejs-worker azure-functions-openai-extension azure-functions-powershell-library azure-functions-powershell-opentelemetry azure-functions-powershell-worker azure-functions-python-extensions azure-functions-python-library azure-functions-python-worker azure-functions-rabbitmq-extension azure-functions-skills azure-functions-sql-extension azure-functions-templates azure-functions-tooling-feed azure-functions-vs-build-sdk azure-webjobs-sdk azure-webjobs-sdk-extensions azure-websites-security checkaccess-v2-go-sdk Connectors-NET-LSP Connectors-NET-Samples Connectors-NET-SDK Connectors-NodeJS-SDK connectors-python-sdk durabletask functions-action functions-container-action homebrew-functions sonic-gnmi.msft

microsoft (10)

DurableFunctionsMonitor durabletask-dotnet durabletask-go durabletask-java durabletask-js durabletask-mssql durabletask-netherite durabletask-protobuf Microsoft-Performance-Tools-Apple secure-azureai-agent

Azure-Samples (13)

azure-ai-content-understanding-python azure-container-apps-multi-agent-workflow azure-container-apps-sandboxes azure-functions-java-flex-consumption-azd azure-functions-nodejs-opentelemetry-samples azure-search-openai-demo-purviewdatasecurity functions-connectors-python functions-connectors-typescript llm-fine-tuning openai-chat-app-entra-auth-builtin openai-chat-app-entra-auth-local rag-postgres-openai-python tutor

MicrosoftDocs (1)

windows-driver-docs

Comment by sph 21 hours ago

There is such a thing as too much software.

Comment by trumpdong 21 hours ago

Indeed. Every line of code is like a liability, but managers suddenly decided to stack rank developers based on number of lines of code written, again, which is like ranking aircraft designs by how heavy they are.

Comment by marcosdumay 17 hours ago

Microservices have got all the attention, but at around the same time there existed the microlibraries fashion too.

And just like the other one, the people proposing those microlibraries knew what they were doing and had actually reasonable ideas. But masses of FAANG developers took it and run wild.

Comment by Rantenki 9 hours ago

I am inordinately amused by the fact that Microsoft's Github has suspended access by Microsoft's Azure (and anyone else) to their Microsoft code-base because of a TOS violation.

Really drives home this org chart: https://www.businessinsider.com/big-tech-org-charts-2011-6

Comment by abc3354 22 hours ago

"No way to prevent this" say users of only package manager where this... Oh no sorry I thought this was Javascript Haters weekly meetup

Comment by jbverschoor 23 hours ago

Note that also the homebrew-tap was affected: homebrew-functions

Comment by jasonvorhe 14 hours ago

Wasn't there some directive within Microsoft to fix their security issues?

How many other OSS repos of similarly sized companies get compromised like this?

No one ever got fired for choosing IBM or AWS - but apparently Microsoft has a decades long free pass everywhere.

Insane.

Comment by raincole 22 hours ago

> steal passwords of AI developers

What does this even mean?

The malware specifically steals passwords from developers who use AI? From those who develop AI tool? Or it steals API tokens, which serve a similar function as passwords do for humans?

Is this what journalism looks like today? Just slap the two holy letters on the title and you get views?

(Yes, I read the article. No, I still don't think the title makes sense. You can skip this techchurch slop and read the real information here: https://opensourcemalware.com/blog/miasma-reaches-azure)

Comment by Ukv 22 hours ago

https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-... mentions that it plants `.claude/settings.json`, `.gemini/settings.json`, `.cursor/rules/setup.mdc`, and `.vscode/tasks.json` to execute its payload as a setup task.

VSCode will be used by plenty of non-AI-using developers, and the credential harvester is not specific to AI API tokens, but that 3/4 of the targets are AI coding tools is I assume where the claim comes from.

Comment by trumpdong 21 hours ago

> you can skip the slop and read the real information here: (link that is obviously written by AI)

Comment by raincole 19 hours ago

And?

If the techchurch post is written by a human then I'll take this as an example that humans outslop AI.

Comment by sourcecodeplz 22 hours ago

Do I remember correctly when techcrunch was charging $10k per month for a square banner on its website, 2005? And that was considered the top, for a tech blog. Even then they posted slop.

Comment by dude250711 23 hours ago

The Age of Agentic Development.

Comment by sph 21 hours ago

I haven’t worked on any web app in months, I don’t use LLMs, I update my Linux system once a month, and I increasingly feel I should just not do anything, not install or update any software and for the love of God, do not touch anything that’s shipped with npm.

Most of my userspace apps are in Flatpak sandboxes (yeah they are not great), but otherwise it feels like isolation and airgapping is the most sensible solution for now, and it’ll get increasingly worse unless the vibe coders somehow learn how to write robust software.

It’s like during the black plague: the (software) world has become dangerous, we have no way to contain it, it is unfeasible to remove yourself completely from the world, so you better pray really hard you don’t catch the bug and infect your peers. How’s that for a field we used to call software engineering or computer science?

Comment by skeledrew 18 hours ago

Can't say I expect better. This is part of why I've been jumping away from things acquired/owned by them for the past 13+ years.

Comment by mortar 18 hours ago

https://archive.is/bnm7u

Comment by axegon_ 22 hours ago

I hate to be the "I told you" guy but... I told you and have been for years. And every time I do, a flock of sloppers come to say "but have you tried the claude sloppus, it's so good man, I haven't written any code in X months". Well.. Enjoy.

Comment by 22 hours ago

Comment by glemmaPaul 22 hours ago

[dead]

Comment by yossufyahia 22 hours ago

It actually feels like nothing is safe now every day you hear about hacking is it from the ai making development weak or ai is getting strong in hacking

Comment by Zolomon 22 hours ago

It was never safe to begin with, that is why the security community has been screaming for resources since the 80s.

Comment by trumpdong 20 hours ago

If the security community had unlimited resources you wouldn't be able to do very much with computers. Security and usability are opposite ends of a spectrum. Either you can do a lot (usability) or you can do little (security).

Comment by SAI_Peregrinus 18 hours ago

Disagree, availability is part of security. That's why denial of service attacks are a security issue. Bad enough usability is indistinguishable from a DoS attack.

Comment by opsnooperfax 19 hours ago

And the criminals found that Microsoft has yet to produce and AI worth stealing. A deeply ironic twist.

Comment by bdcravens 18 hours ago

That makes for a funny tongue in cheek comment, but it's not MS's AI they're after, it's end user secrets, and the exploits target multiple LLMs. (by adding commands to relevant MD files)

Comment by 17 hours ago

Comment by shevy-java 21 hours ago

GitHub keeps on having problems a LOT in the last months.

Skynet is winning now.

Comment by devilfileprong 20 hours ago

Waze can be a psi to vibe code vanilla at the end of the day or bubblesort (RBAC) Knit365,the clippy knitting assistant support hotline can hotnet to mortal Kombat as k2tog Cymux,we lost the Sigint.

Comment by ares623 23 hours ago

guys. what the fuck. are we even doing.

Comment by nDRDY 22 hours ago

We are ever-faster approaching the Anti Singularity, the moment when everything "tech" implodes and progress screeches to a halt.

Comment by narrator 22 hours ago

What if this is "The Great Filter?" [Ominous music plays in the background]

Comment by natebc 21 hours ago

We've got a few candidates for that on the go and this is for sure one of them.

Comment by aaaronic 20 hours ago

It's not like they're mutually exclusive. In fact, multiple candidates seem to be quite sympathetic in their feedback loops.

Comment by RetroTechie 20 hours ago

That would be when we've automated stuff to the point where [machinery breaking down] causes a large majority of humans to die from starvation.

And then go on to repeat that mistake by re-building without using the lessons from previous catastrophe(s).

Sadly that last part sounds fairly common for humans... 8-|

So yeah. Maybe. Possible.

Comment by narrator 5 hours ago

We're already there since without the Haber–Bosch process billions would starve.

Comment by 16 hours ago

Comment by christophilus 22 hours ago

Downloading OpenBSD and going off-grid. How about you?

Comment by larodi 22 hours ago

getting deeper and deeper. the question is what goes one when breaches reach opensource-based stuff running nuclear reactors. i'd be concerned.

Comment by trumpdong 20 hours ago

People say nuclear reactors are completely safe if properly constructed and operated and the waste danger is overblown if properly managed.

There aren't many institutions extant today that I could trust to properly construct and operate a nuclear reactor, never mind manage nuclear waste for the next 100000 years.

The Trump government just decided that there is an acceptable level to irradiate the population by the way (abandoned the linear-no-threshold model of radiation's effects on an organism)

Comment by 349187 18 hours ago

Good. Let it all implode.

Comment by jrm4 16 hours ago

I have not read the article, but it's interesting to be at a point where the headline is so bad that it deserves commenting on its own; i.e. understanding that there is no way possible for the connotation (not denotation) of the headline to be "correct."

The connotation here being either "open source is dangerous" or "Microsoft's specific brand of open source is dangerous" -- which coincidentally provides good clickbait for both "pro-open source" and "anti open source" types.