微软73个开源包被植入凭据窃取器，AI编码代理触发
微软开源包再遭投毒，73个包被植入凭据窃取器
供应链安全是AI开发者的头等大事，这次攻击专门针对AI编码代理，建议立即检查你的依赖中是否包含这些包，并轮换所有可能泄露的凭据。
Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents.
In all, multiple researchers said, 73 packages were flagged as malicious when automated systems on GitHub blocked them on the platform. Rather than noting they are malicious—and that developers who used AI agents to work with them should assume their systems are compromised—the Microsoft-owned GitHub said it disabled the packages “due to a violation of GitHub's terms of service.” The text went on to encourage the package owner to contact GitHub.
Devs: Assume compromise and proceed accordingly
It wasn’t until Monday that Microsoft even raised the possibility the packages were infected. In an email, the company stated: “We have temporarily removed some repositories as we investigate potential malicious content.”
Read full article
Comments
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力