Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI coding agents.



ars Technica: For the 2nd time in weeks, Microsoft packages laced with credential stealer

Microsoft has cut off access to dozens of its open source projects hosted on GitHub as it investigates how hackers apparently breached the projects and injected password-stealing malware into the code.

According to security firm Cloudsmith and community-driven malware analysis site OpenSourceMalware, which were some of the first to flag the hack, the malware allowed the hackers to steal the users’ passwords and other sensitive credentials when they opened the compromised tools in their AI coding apps.

Tech Crunch: Microsoft’s open source tools were hacked to steal passwords of AI developers

Cloudsmith appointed Mark O'Connor as Chief Financial Officer and Dan Lascell as General Counsel, strengthening its executive leadership team as the company scales to meet the demands of Fortune 500 and Global 2000 customers. The hires follow Cloudsmith's $72M Series C and position the company to meet IPO-scale financial, legal, and governance standards.


Cloudsmith Expands Leadership with CFO and General Counsel Appointments

Cloudsmith Inc., a startup that helps software teams manage application components, has secured $72 million in new funding.

The Series C round was led by TCV, which was also the biggest backer of the company’s previous raise last year. Cloudsmith stated in its funding announcement today that the venture fund was joined by other existing investors and Insight Partners. The company’s total outside funding now exceeds $110 million.

Silicon Angle: Software artifact management startup Cloudsmith raises $72M

Featured Releases

Oversubscribed funding round by TCV and Insight Partners accelerates Cloudsmith’s global ambitions 

Cloudsmith Raises $23M Series B to secure the future of software supply chains

Other Announcements

Media Contact

Belfast, UK, 23 April, 2026 — Cloudsmith, the universal artifact management platform trusted by some of the world's leading enterprises, today announced a $72M Series C financing led by TCV and with participation from Insight Partners, along with investments from other existing investors. The additional funding positions Cloudsmith for massive growth to power the era of AI-driven software development.

Cloudsmith Raises $72M Series C Led by TCV and Insight Partners to Control and Secure the AI-Powered Software Supply Chain

Cloudsmith announced an expansion of its advanced security capabilities, framing the platform as a unified control plane that bridges the gap between threat intelligence and active enforcement. The release highlights two core capabilities — continuous package enrichment (pulling from OSV.dev, EPSS, and OpenSSF malicious package data) and OPA-based policy management with features like cool-down periods, exploitability prioritization, deep SBOM inspection, and malicious package detection. The underlying argument: security tools surface risk just fine, but enforcement is disconnected from where software actually moves — and Cloudsmith fixes that.