Microsoft open source tools hacked to steal passwords

Microsoft disabled dozens of GitHub repos after hackers injected password-stealing malware into open source projects for Azure and AI developer tools like Claude Code and VS Code. Security firm Cloudsmith flagged the supply chain attack. The malware stole credentials when users opened compromised tools in AI coding apps.