AI Coding Agents Weaponized in Repeated Microsoft npm Supply Chain Breach

This breach redefines supply-chain vulnerabilities by turning AI coding assistants into automatic execution triggers, eliminating the need for developers to actively run malicious code. It also highlights a critical flaw in current trust models, as stolen credentials successfully bypassed SLSA provenance checks. The recurring compromise of a major Microsoft account exposes severe gaps in enterprise credential management and ecosystem security.