Self-replicating Miasma worm compromises 73 Microsoft GitHub repositories in supply chain attack

Second Breach in Weeks Exposes Microsoft GitHub Repositories

Microsoft GitHub repositories fell victim to a sophisticated supply chain attack last week when 73 projects across Azure, Microsoft, Azure-Samples, and MicrosoftDocs organizations were compromised with credential-stealing malware1

1

. GitHub's automated systems flagged and disabled all affected repositories within 105 seconds on June 5, though the platform initially cited only "a violation of GitHub's terms of service" without acknowledging the security breach2

2

. This marks the second time in as many months that an official Microsoft repository account has been breached, with the same durabletask package targeted in both incidents1

1

.

How the Self-Replicating Miasma Worm Operates

The Miasma malware deployed in this cybersecurity incident represents an evolution in supply chain attacks, specifically engineered to exploit AI coding tools including Claude Code, Gemini CLI, Cursor, and VS Code5

5

. The attack began when a compromised contributor account pushed a malicious commit to Azure/durabletask, dropping configuration files that triggered remote code execution the moment a developer opened the repository in an IDE or AI coding agent2

2

. The password-stealing malware executes a 28 KB payload that harvests credentials from AWS, Azure, GCP, Kubernetes, password managers, and over 90 developer tool configurations1

1

. Once activated, the worm spreads laterally through cloud infrastructures to infect other developer machines, using stolen tokens to commit itself into any repository the victim can write to5

5

.

TeamPCP and the Mini Shai-Hulud Connection

The attack has been linked to TeamPCP, a threat actor that recently open-sourced the Mini Shai-Hulud toolkit upon which the Miasma malware is based1

1

. However, because TeamPCP released the source code publicly, security researchers cannot definitively confirm whether the group itself executed this attack or if other actors leveraged the toolkit2

2

. The original Shai-Hulud worm first appeared in September 2025 as the first self-replicating malware observed in the npm ecosystem, and has since mutated across npm and PyPI platforms, previously compromising 32 Red Hat packages5

5

. The software supply chain campaign has also infected packages from TanStack, Mistral AI, and UiPath, with more than 80 public repositories on GitHub carrying the Miasma campaign's naming pattern5

5

.

Exploiting Trust Rather Than Vulnerabilities

What makes this information stealer particularly insidious is that it doesn't exploit software vulnerabilities in GitHub or npm1

1

. According to Cloudsmith, the attack exploits the underlying trust model of the modern engineering ecosystem by stealing legitimate maintainer credentials and using them to request valid GitHub OIDC tokens1

1

. The malicious builds were published with valid SLSA provenance attestation, causing conventional scanners to see them as routine trusted updates1

1

. The Miasma worm generates a uniquely encrypted payload for each individual infection, rendering traditional hash-based indicators of compromise functionally useless for broad detection1

1

.

Immediate Impact on CI/CD Pipelines and Developer Workflows

The removal of compromised open-source packages caused immediate disruption to development workflows, particularly affecting Azure/functions-action, a GitHub Action used by developers to deploy code to Azure2

2

. Every workflow referencing Azure/functions-action@v1 stopped resolving when the repository was taken down, breaking CI/CD pipelines for numerous developers2

2

. Microsoft confirmed it "notified a small number of customers who may have pulled down content from the affected repositories" and stated that some repositories have been restored after review while others remain offline pending investigation4

4

. The durabletask package on PyPI, which receives 400,000 downloads per month, was previously compromised on May 19 when three malicious versions were uploaded within a 35-minute window1

1

.

Unanswered Questions About Credential Management

The fact that the same Microsoft GitHub account was compromised twice raises critical questions about credential rotation practices1

1

. Security researcher Paul McCarty noted that "when the repo at the root of last month's compromise is the hub of this month's takedown, that is not a coincidence, that is the same wound reopening"5

5

. StepSecurity's analysis suggests the re-targeting of durabletask indicates that tokens associated with the compromised developer account used in the PyPI attack were not fully rotated, allowing attackers to push commits to GitHub2

2

. Alternative explanations include re-compromise through the worm's own propagation loop or the use of a different contributor's token with altered metadata to disguise the attack2

2

.

Expanding Attack Surface Targets AI-Assisted Development

The targeting of AI coding tools represents a notable evolution in supply chain attacks, exploiting behavior patterns that didn't exist a year ago5

5

. Developers increasingly rely on tools like Claude Code and Cursor to work with unfamiliar repositories, and the worm activates precisely when an AI agent opens a project5

5

. Recent analysis uncovered a newer PyPI wave tied to the broader Mini Shai-Hulud, Miasma, and Hades waves, infecting an additional 23 packages including bioinformatics-related libraries and AI-themed packages4

4

. Socket reported that the latest cluster employs new payload delivery mechanisms, including trojanized native .abi3.so extensions that execute the stealer when packages are imported, indicating threat actors are actively experimenting with different methods4

4

. Security experts recommend that software developers lock project dependencies, add multi-day time delays to fetch new package updates, and test new builds on isolated environments3

3

.