微软官方开源软件包在数周内第二次遭到入侵，73个软件包被注入了旨在窃取凭证的恶意代码。当开发人员使用AI编码代理打开这些软件包时，这些代码就会被激活，可能通过窃取AWS、Azure和GCP等云提供商的令牌，以及密码管理器和开发人员工具的凭证来危及系统。此次攻击与威胁组织TeamPCP有关，使用了名为Miasma的恶意软件，并通过利用合法的微软OIDC令牌绕过了存储库构建管道。 AI
影响 受损的AI开发工具和软件包对AI项目和基础设施的安全性构成了重大风险。
排序理由 此集群描述了一起涉及受损软件包的安全事件，而不是新的AI模型发布或核心AI研究。
AI 生成摘要 · Google Gemini · 来自 3 个来源。 我们如何撰写摘要 →
73 packages run self-replicating stealer as soon as they're opened by an AI agent.
For the second time in weeks, Microsoft packages have been found laced with credential-stealing code designed to activate when developers open them in AI coding agents. 73 packages were blocked on GitHub, executing a payload that steals credentials from AWS, Azure, GCP, Kubernete…
For the 2nd time in weeks, # Microsoft packages laced with # credential stealer Dozens of # cryptographically verified # opensource packages from Microsoft were # compromised late last week to add advanced credential-stealing code that was triggered when # developers opened them …