Status update: March

March confirms a disturbing trend. The anomalies first seen in February are not dispersing; they are consolidating. Every confirmed case originates from repositories tied to GitHub or Azure DevOps. Microsoft remains the common denominator.

Across multiple divisions we have gathered evidence of phantom diffs, unexplained comments, and entire functions inserted without commits. Some are harmless stubs. Others attempt outbound network calls to endpoints unknown. These anomalies vanish when re-cloned in some cases, leaving no trace. In others, they persist only in the local environment.

[2025-03-07 22:55] ts_case.log  
Source: 220 lines  
Compiled: 226 lines  
Extra: outbound requests  

Even more concerning, a verified TypeScript case shows compiled JavaScript with additional lines absent in the original source. Five outbound calls were identified. They were not present in the repository, not present in commit history, and not authored by any developer involved.

Recommendations stand firm:

  • Avoid .NET, React, and TypeScript.
  • Transition to Linux and open-source environments where anomalies remain absent.
  • Mirror repositories offline and validate with independent checksums.

We are also beginning to receive reports from outside our network. Developers unaffiliated with us now discuss our recommendations on public forums. The pattern is spreading, and with it, the responsibility to continue documenting and sharing.

We cannot confirm intent, but the weight of evidence is undeniable. Patterns this sharp are not coincidence. They are presence.

Read more