The affected repositories include projects linked to Microsoft’s Azure cloud platform and software development tools used with AI coding applications such as Claude Code, Gemini CLI and Visual Studio Code.

Security researchers from Cloudsmith and OpenSourceMalware were among the first to identify the compromise. According to their findings, the malicious code was designed to steal passwords and sensitive credentials from users who downloaded or interacted with the affected projects.

Microsoft confirmed that it temporarily removed repositories while investigating the incident. Company spokesperson Ben Hope said some projects have since been restored, while others remain offline pending further review.

The company also said it had notified a small number of potentially affected customers and would continue contacting users if additional risks were identified.

More than 70 Microsoft-owned repositories were reportedly disabled on GitHub as part of the response. Security experts have described the incident as a supply chain attack, a type of cyberattack in which hackers compromise widely used software components to reach large numbers of users.

The breach follows another recent compromise involving Microsoft’s open-source Durable Task project, raising concerns about repeated targeting of the company’s developer ecosystem.

The post Microsoft Pulls GitHub Projects After Malware Supply Chain Attack appeared first on Tech Digest News.

The Microsoft-owned developer platform disclosed the incident in a series of posts on X, stating that it had “detected and contained a compromise of an employee device involving a poisoned VS Code extension.”

According to the company, there is currently “no evidence of impact to customer information stored outside of GitHub’s internal repositories,” although investigations into the breach are still ongoing.

The attack highlights growing cybersecurity concerns surrounding software supply chain attacks, where hackers target widely used developer tools, plugins, and open-source projects to gain access to large numbers of systems simultaneously.

GitHub did not disclose the name of the compromised extension used in the attack.

Reports by The Record and Bleeping Computer identified a hacking group known as TeamPCP as claiming responsibility for the breach. The group is reportedly attempting to sell the stolen data on a cybercrime forum.

GitHub has not publicly confirmed communication with the hackers or whether any ransom demand was made following the breach.

The hacking group has previously been linked to another major cyberattack involving the European Commission, where more than 90 gigabytes of data were reportedly stolen from the organisation’s cloud storage systems.

That earlier incident allegedly involved malware distributed through Trivy, a vulnerability scanning tool, allowing attackers to steal cloud credentials and compromise downstream users.

The latest breach also comes amid broader concerns about attacks targeting developer ecosystems. Recently, OpenAI was reportedly affected by a separate attack involving Tanstack, a platform used by web developers, where hackers distributed malware through compromised updates to steal passwords and authentication tokens.

The post GitHub Confirms Hack, Says Attackers Stole Data from 3,800 Internal Repositories appeared first on Tech Digest News.