Compromised Microsoft Packages Weaponize AI Agents to Steal Developer Credentials

This incident highlights a severe escalation in supply-chain attacks, specifically targeting the expanding use of AI coding agents in developer workflows. By compromising cryptographically verified packages and harvesting OIDC tokens, threat actors are successfully bypassing established software integrity frameworks like SLSA. This forces the tech industry to urgently re-evaluate the inherent trust placed in official open-source repositories and automated AI tools.