Security News > 2021 > March > Microsoft's Azure SDK site tricked into listing fake package
A security researcher was able to add a counterfeit test package to the official list of Microsoft Azure SDK latest releases.
The simple trick if abused by an attacker can give off the impression that their malicious package is part of the Azure SDK suite.
As of a few days ago, the Azure SDK releases page showed the authentic Microsoft Azure SDK releases alongside the mysterious package alexbirsantest.
One of the users pointed out that a GitHub commit was pushed by the "Azure-sdk" bot and added the alexbirsantest package to the CSV file supposedly used for populating the Microsoft Azure SDK releases page.
An adversary being able to add a malicious package with a name similar to other Azure SDK packages can easily disguise their malware as a part of the official Azure SDK releases.
As seen by BleepingComputer, Microsoft has now removed the alexbirsantest package from the list of their official Azure SDK latest releases.