73 Microsoft Packages Weaponized in Password Stealer Attack

GitHub disabled 73 Microsoft repositories across Azure, Azure-Samples, microsoft, and MicrosoftDocs within 105 seconds after automated abuse detection—an event consistent with credential-exfiltration and supply-chain weaponization linked to Miasma/TeamPCP activity. The takedown affected critical CI/CD and runtime components (Azure Functions, Durable Functions, actions used by many workflows), and the report warns that stolen automation credentials and forked malware that collect cloud/GitHub tokens can both enable widespread compromise and trigger large-scale automated enforcement; recommended mitigations include pinning actions to commit SHAs, rotating targeted credentials, scanning for indicators (obfuscated loaders, Bun preinstall calls), and using alternate deployment methods.