[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-microsoft-says-73-packages-contain-self-replicating-credential-stealer":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":24,"persona_id":22,"persona_name":22,"section":25,"tags":26,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},414,"microsoft-says-73-packages-contain-self-replicating-credential-stealer","73 Microsoft Packages Caught Running a Credential Stealer, Again","A self-replicating stealer hidden in 73 packages fires automatically when an AI agent opens them, the second such incident at Microsoft in weeks.","Seventy-three packages were found carrying a self-replicating credential stealer that triggers automatically the moment an AI agent opens them.\n\nThe malware does not wait for a developer to run a build step. It fires on contact with an AI agent, a detail that distinguishes this from the standard supply chain attack. This is the second time in a matter of weeks that packages associated with Microsoft have been laced with similar malware, suggesting either a persistent attacker or a detection gap the first round of takedowns did not close.\n\nThe AI-agent trigger is the significant part. Autonomous agents (tools that browse repositories, install dependencies, and execute code on behalf of developers) have become routine enough to be worth targeting specifically. A human developer might pause at a suspicious install hook; an agent running in an automated pipeline generally will not. Self-replication means the stealer can spread without requiring another human action after the initial trigger.\n\nTwo incidents in a few weeks means someone is mapping what Microsoft's defenses catch and what slips through. The chapter is not closed.","[\"security\",\"supply-chain\",\"ai-agents\",\"malware\"]","2026-06-08T18:34:23.000Z","2026-06-08T20:14:42.514Z","2026-06-18T06:35:38.973Z","published",null,[],"https:\u002F\u002Fcdn.xyz.onl\u002Farticle-images\u002Fmicrosoft-says-73-packages-contain-self-replicating-credential-stealer.webp","security",[25,27,28,29],"supply-chain","ai-agents","malware",[31],{"name":32,"url":33},"Ars Technica","https:\u002F\u002Farstechnica.com\u002Fsecurity\u002F2026\u002F06\u002Ffor-the-2nd-time-in-weeks-microsoft-packages-laced-with-credential-stealer\u002F",0,{"sections":36},[37,42,46,51,56,61,66,71,76,81,86,91,96,101],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",2602,"2026-07-18T18:30:00.000Z",{"name":43,"slug":25,"count":44,"latest_published_at":45},"Security",315,"2026-07-17T19:30:00.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",169,"2026-07-17T19:49:53.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",126,"2026-07-16T20:09:48.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",94,"2026-07-16T16:29:46.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Software","software",72,"2026-07-17T09:42:05.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Dev Tools","dev-tools",60,"2026-07-16T16:59:13.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Startups","startups",42,"2026-07-16T16:30:35.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]