TeamPCP Injects Malware into Microsoft-Linked GitHub Repositories
TeamPCP Injects Malware into Microsoft-Linked GitHub Repositories is a high-severity supply chain compromise issue in Azure / Azure-Samples / Microsoft GitHub repos touched, an AI agent. Affected: Azure / Azure-Samples / Microsoft GitHub repos touched 02:36-03:22 UTC 5 June 2026. It has been exploited in the wild.
Is Azure / Azure-Samples / Microsoft GitHub repos touched running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
teampcp-injects-malware-into-microsoft-linked-github-repositories- Severity
- high
- Attack type
- Supply chain compromise, Malware
- Component
- Azure / Azure-Samples / Microsoft GitHub repos touched · AI agent
- Known exploited
- Yes
- Published
- Last verified
What is this vulnerability?
TeamPCP used a compromised GitHub account to inject malicious code into at least 42 repositories and 236 branches across the Azure, Azure-Samples, and Microsoft GitHub organizations (published 02:36-03:22 UTC on 5 June 2026). The malicious code remained in the GitHub repos and had not been pushed to other distribution channels as of disclosure.
Affected versions
| Affected | Fixed in |
|---|---|
Azure / Azure-Samples / Microsoft GitHub repos touched 02:36-03:22 UTC 5 June 2026 | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Azure / Azure-Samples / Microsoft GitHub repos touched 02:36-03:22 UTC 5 June 2026.
How do I fix it?
Do not build from affected branches; verify commit provenance and pin to known-good SHAs. Review any clones/forks pulled around 5 June 2026 and scan for injected code before use.
How do I find every machine running Azure / Azure-Samples / Microsoft GitHub repos touched?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Azure / Azure-Samples / Microsoft GitHub repos touched and which version, then enforce a policy on it.