For the 2nd time in weeks, Microsoft packages laced with credential stealer

I'll admit that I giggled over one of the infected repos being microsoft/secure-azureai-agent, especially when the worm plants files to get AI agents to infect you.

Has anyone seen any fallout from this?