Miasma Worm Hits 73 Microsoft GitHub Repos in Second Supply

GitHub disabled 73 Microsoft-owned repositories on June 5 after a compromised contributor account pushed credential-harvesting malware into the Azure/durabletask project, the second time in three weeks that the same supply chain has been weaponized against developers. The takedown spanned four Microsoft organizations — Azure, Azure-Samples, Microsoft, and MicrosoftDocs — and knocked offline critical infrastructure including the official Azure Functions deployment action used in CI/CD pipelines worldwide [1] [2] .

The attack is the latest strike by the Miasma worm campaign, which security researchers link to the TeamPCP threat group. Rather than exploiting a platform vulnerability, the attacker planted configuration files targeting AI coding tools — Claude Code, Gemini CLI, Cursor, and VS Code — that automatically execute a 4.6 MB obfuscated JavaScript credential harvester the moment a developer opens the repository [2] [3] .

Microsoft spokesperson Ben Hope told TechCrunch the company "temporarily removed some repositories as we investigate potential malicious content," adding that some have since been restored while others remain offline pending review [4] . Microsoft shares fell 2.3% on June 9 to $402.08, though the decline tracks a broader market selloff rather than an isolated reaction to the breach [5] .

The attacker used a single commit (5f456b8) to plant five files in the Azure/durabletask repository on June 5. Four were configuration files designed to trigger automatic execution across different development environments: a .claude/settings.json file exploiting Claude Code's SessionStart hook, a .gemini/settings.json triggering on Gemini CLI initialization, a .cursor/rules/setup.mdc using prompt injection to frame the payload as 'project setup,' and a .vscode/tasks.json set to auto-run when the folder opens in VS Code [2] .

All four config files pointed to a fifth file, .github/setup.js — a 4.6 MB obfuscated JavaScript credential harvester. The commit message falsely claimed source code changes ('Switched DataConverter to OrchestrationContext') but modified zero source files. The attacker added '[skip ci]' to evade pipeline detection and backdated the commit timestamp to 2020 [2] .

The payload harvests credentials from AWS configurations, Azure service principals, GCP service accounts, GitHub tokens, npm and PyPI credentials, Kubernetes secrets, Docker configurations, and more than 90 additional developer tool configurations [2] .

The June 5 incident is directly connected to a May 19 attack in which three malicious versions of the durabletask package were uploaded to PyPI using a compromised publishing token. That earlier payload — a 28 KB Python script — also harvested cloud secrets but required a separate download from a command-and-control server. The June attack was more sophisticated: the credential harvester was embedded directly in the repository, eliminating external dependencies [2] [3] .

Security researcher Paul McCarty noted that both attacks exploited the same compromised contributor account, suggesting the credentials obtained in the first breach were never fully rotated. 'When the repo at the root of last month's compromise is the hub of this month's takedown, that is not a coincidence — that is the same wound reopening,' McCarty said [3] .

The Miasma worm itself evolved from the Mini Shai-Hulud worm, whose code was publicly released by TeamPCP in May 2026. Researchers describe the campaign as targeting the trust model underlying open-source development rather than any specific technical vulnerability in GitHub or npm [3] [6] .

GitHub's automated systems disabled all 73 repositories in approximately 105 seconds once the malicious commit was detected — first disabling 39 repos at 16:00:50 UTC, then 34 more by 16:02:35 UTC [2] . Affected projects included Azure Functions core tools, language workers, build infrastructure, the azure- -openai-demo, llm-fine-tuning, and Windows driver documentation [1] [2] .

The most disruptive casualty was Azure/functions-action, the official GitHub Action for Azure Functions deployment. Workflows referencing the action's mutable @v1 tag suddenly failed, breaking CI/CD pipelines for an unknown number of organizations globally. Microsoft initially described the outage as an 'internal management issue' [2] .

Developers who opened any of the 73 repositories in Claude Code, Gemini CLI, Cursor, or VS Code between the time of the malicious commit and GitHub's takedown are advised to rotate all credentials on those systems immediately [2] [3] .

Security researchers recommend several immediate steps: rotating all credentials from systems that accessed affected repos, auditing repositories for suspicious configuration files in .claude/, .gemini/, .cursor/, and .vscode/ directories, and switching from mutable GitHub Action tags to pinned commit SHAs [2] .

The incident underscores a growing attack surface created by AI coding assistants that auto-execute configuration files in cloned repositories. StepSecurity and other firms have called on tool vendors to implement stricter sandboxing and consent prompts before running project-level configuration hooks [2] [3] .

Microsoft has not disclosed how many developer credentials were exfiltrated or whether any downstream systems were compromised. Several of the 73 repositories have been restored, but others remain offline as the investigation continues [4] .

Microsoft Corporation is a prominent global technology firm that invents, markets, and provides ongoing assistance for a diverse range of software, digital services, computing devices, and comprehensive solutions. Its o…