For the 2nd time in weeks, Microsoft packages laced with credential stealer

Dozens of Microsoft-owned open-source packages on GitHub were compromised to deliver Miasma, a credential‑stealing malware that harvests OIDC tokens and credentials for AWS, Azure, GCP, Kubernetes, password managers and many developer tools, then spreads laterally; 73 packages were flagged and the activity has been linked to threat actor TeamPCP, with Microsoft temporarily removing affected repositories while investigating.