Why Microsoft has shut down code repositories on GitHub
What's the story
Microsoft has suspended access to several of its open-source projects on GitHub after a major security breach. The company is now investigating how hackers managed to infiltrate these projects and inject malware designed to steal passwords. The affected projects are mainly associated with Microsoft's cloud service Azure and tools for AI development apps like Claude Code, Gemini's command line interface, and VS Code.
Security breach
Hackers stole user passwords
The malware was some of the first flagged by security firm Cloudsmith and community-driven malware analysis site OpenSourceMalware. They reported that the malicious software enabled hackers to steal user passwords and other sensitive credentials when they opened the compromised tools in their AI coding apps. The exact number of people who have downloaded these affected tools remains unknown at this time.
Response to breach
Access to these repositories disabled
Microsoft has confirmed the suspension of its repositories, as first reported by 404 Media. A message now appears when trying to access these projects' pages on GitHub, stating, "Access to this repository has been disabled by GitHub Staff due to a violation of GitHub's terms of service." This incident is the latest in a series of supply chain attacks where hackers target popular open-source projects with malware.
Attack strategy
Supply chain attacks target code
Supply chain attacks target code that is often used in a large number of software products or by specific types of users. These attacks can be lucrative as they sometimes provide access to cloud systems and large amounts of customer data. While individual developers of open-source projects are often targeted, it is rare for tech giants like Microsoft to fall victim to such breaches.
Previous incidents
Microsoft previously breached in mid-May
This is not the first time Microsoft has faced a breach in its open-source projects. In mid-May, security researchers reported that Durable Task, an open-source project by Microsoft designed to help developers build apps, was hacked. OpenSourceMalware noted that this latest incident is a "re-compromise" of the Durable Task project, indicating either an incomplete removal of hackers or a completely new breach.