Active Flaws in PowerShell Gallery Expose Users to Attacks

Aqua Nautilus discovered three security flaws in the PowerShell Gallery—permissive package naming that enables typosquatting, spoofable package metadata that masks true ownership, and an API that leaks unlisted package versions (exposing secrets). They built a PoC malicious module (Az.Table) that executed on import and received callbacks from cloud hosts, demonstrating realistic supply-chain and credential-exposure risks; Microsoft was notified but fixes appear incomplete as of August 2023.