On June 5, 2026, in a containment action that took just 105 seconds, GitHub disabled 73 Microsoft repositories across four of its own GitHub organizations. The repositories, spanning the Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations, were taken offline in an automated sweep after the Miasma self-replicating worm planted malicious code that harvests developer credentials. It represents the most significant escalation yet in an ongoing supply chain attack campaign that has been spreading across the open-source ecosystem for weeks.Anyone attempting to access one of the affected repositories today is met with the same blunt message from GitHub: “Access to this repository has been disabled by GitHub Staff due to a violation of GitHub’s terms of service. If you are the owner of the repository, you may reach out to GitHub Support for more information.”
What Was Taken Down and Why It Matters
The disabled repositories were not peripheral projects. The entire Azure Functions organization, the whole Durable Task family, and a row of AI sample repositories were among those swept offline. Among the most notable casualties reported by OpenSourceMalware were azure-search-openai-demo-purviewdatasecurity, durabletask, durabletask-dotnet, durabletask-go, durabletask-js, durabletask-mssql, functions-container-action, homebrew-functions, llm-fine-tuning, and windows-driver-docs.
Azure-Samples alone lost thirteen repositories, heavily weighted toward AI and agent tooling, including rag-postgres-openai-python, azure-container-apps-multi-agent-workflow, and llm-fine-tuning.
What makes the Microsoft incident stand out is that it is not simply a new target being compromised. It is the reopening of a wound that was never fully closed. The campaign includes a re-compromise of the durabletask PyPI package, which was previously infected by TeamPCP last month to deliver an information stealer on Linux systems.
Security researcher Paul McCarty, known online as 6mile, described the significance of that detail in stark terms. “A month later, not only is Azure/durabletask gone, so is every sibling repo in the Durable Task ecosystem, sitting one org over in Microsoft: the .NET, Go, Java, JS, MSSQL, Netherite, and protobuf implementations, plus the Durable Functions monitor,” McCarty said. “When the repo at the root of last month’s compromise is the hub of this month’s takedown, that is not a coincidence. That is the same wound reopening. Whoever held those credentials in May plausibly never fully lost them.”
That assessment is supported by an uncomfortable timeline. Dark web monitoring firm Whiteintel found that the GitHub credentials and active session cookie used in the attack had appeared in infostealer logs as early as April 13, 2026, and again on May 15, 2026. Forty-eight days passed between the first appearance of those compromised credentials and the attack that followed. The session cookie alone, which would have bypassed multi-factor authentication entirely, was sitting in criminal marketplaces for nearly seven weeks before it was used.
How the Attack Was Carried Out
The compromise of the Azure/durabletask repository was more deliberate than it might first appear. Attackers used a stolen Personal Access Token belonging to an active Microsoft contributor. The malicious commit was backdated to 2020 to hide in a dormant branch, making it far less likely to surface in routine monitoring or trigger alert webhooks connected to active CI/CD pipelines.
The attack planted configuration files that execute a credential-harvesting payload when a developer opens the repository in Claude Code, Gemini CLI, Cursor, or VS Code. The payload is designed to activate the moment a developer clones one of the affected repositories and opens it in an AI coding agent, turning the standard act of loading a project into an attack vector.
The payload operates across Linux, macOS, and Windows by dynamically downloading the correct Bun JavaScript runtime for each platform, although Linux CI/CD runners appear to be the primary intended target.
The Worm’s Origins and Growing Reach
Miasma did not appear out of nowhere. The Shai-Hulud lineage traces back to April 22, 2026, when the first confirmed attack targeted @bitwarden/cli on npm, introducing a signature reference to the sandworms in Frank Herbert’s Dune series. By April 29 and 30, the same framework had compromised SAP npm packages and PyTorch Lightning on PyPI. On May 12, a larger coordinated wave hit more than 160 npm packages, including utilities used by Mistral and TanStack. Shortly after, a group called TeamPCP published the full Shai-Hulud source code to GitHub and advertised it on BreachForums, making the underlying framework available to any actor willing to adapt it.
Miasma itself is a variant of the Mini Shai-Hulud worm that TeamPCP publicly released in mid-May 2026. It has since mutated across npm and PyPI, previously compromising 32 Red Hat packages and hitting TanStack, Mistral AI, and UiPath packages.
The Red Hat incident alone impacted at least 32 packages and 96 compromised versions, affecting software components downloaded between 80,000 and 117,000 times weekly.
As it has evolved, the worm has taken to naming its staging repositories with distinctive descriptions that now serve as fingerprints across the open-source ecosystem. Currently active variants use the descriptions “Miasma: The Spreading Blight,” “Miasma: The Spreading Blight,” “Miasma — The Spreading Blight,” and “Hades — The End for the Damned.” At the time of writing, thirteen repositories carry the “Hades” description and 82 carry the Miasma naming patterns.
Skipping the Registry Entirely
Perhaps the most technically significant development in this latest wave is that the worm has stopped relying on package registries as its primary vehicle. Rather than going through npm, attackers pushed malicious code directly to GitHub source repositories, including icflorescu/mantine-datatable and four sibling projects: mantine-contextmenu, next-server-actions-parallel, mantine-datatable-v6, and mantine-contextmenu-v6.
The malicious commit that appeared on mantine-datatable was disguised as a routine dependency update and authored as github-actions. The commit added no dependencies at all. Instead it planted a 4.3 MB payload runner and wired it to execute automatically through five developer tools: Claude Code, Gemini CLI, Cursor, VS Code, and the npm test script. Five of the six files added by the commit exist solely to launch the sixth. The maintainer’s account was suspended during the incident, and his wife posted the public disclosure on his behalf.
The same fingerprint appears across more than 120 repositories spanning dozens of accounts, including the official Microsoft Azure durabletask repository.
Why Conventional Defences Are Struggling
The reason Miasma has proven so difficult to stop with standard security tooling comes down to how it operates. Rather than exploiting a known vulnerability in npm or GitHub itself, it uses a technique researchers call “Phantom Gyp,” abusing a 157-byte binding.gyp file to trigger code execution during npm install. This bypasses the preinstall and postinstall lifecycle script monitoring that most security tools are built to catch.
More broadly, the campaign exploits the foundational trust model of open-source software delivery rather than any technical flaw in the platforms involved. As FalconFeeds.io put it in its analysis of the campaign, the worm’s approach is built around the assumption that sits at the heart of the entire open-source ecosystem. “It exploits the trust model those platforms are built on: the assumption that if a package is signed with a valid key and published by an authenticated maintainer, it is safe. Shai-Hulud compromises the key and the maintainer, then proceeds to act exactly as a legitimate publisher would. From the registry’s perspective, every malicious publish event is indistinguishable from a routine update.”
Stolen credentials are exfiltrated to ephemeral public repositories created on the fly, such as nemean-hydra-34343, where harvested credentials are uploaded as encrypted JSON files to a results/ directory before the repository is abandoned.
What This Campaign Represents
What separates Miasma from most supply chain incidents is its ability to propagate exponentially across the ecosystem by compromising downstream users and repeating the same cycle. The Microsoft incident makes that dynamic visible in a way that is hard to ignore: in 105 seconds, 73 repositories connected to one of the world’s largest software organizations were taken offline, because credentials stolen months earlier were never fully revoked, and because the act of opening a cloned repository in a modern AI coding tool was enough to trigger the payload.
For developers, the practical takeaway is uncomfortable: the tools and workflows that have become central to modern software development — AI coding agents, automated package management, trusted registry signatures — are now active components of this campaign’s attack surface.
References
- The Next Web — Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack (June 5, 2026). https://thenextweb.com/news/miasma-worm-microsoft-github-supply-chain
- OpenSourceMalware Blog — The Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds (June 5, 2026). https://opensourcemalware.com/blog/miasma-reaches-azure
- SafeDep — Miasma Worm Targets AI Coding Agents via GitHub Repos (June 4, 2026). https://safedep.io/miasma-worm-ai-coding-agent-config-injection/
- StepSecurity — Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp (June 4, 2026). https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
- CybelAngel — Miasma Supply Chain Attack: The Seven-Week Credential Trail (June 2, 2026). https://cybelangel.com/blog/miasma-supply-chain-attack-the-seven-week-credential-trail/
- The CyberSec Guru — Miasma Worm Targets AI Coding Agents: 73 Repos Disabled (June 5, 2026). https://thecybersecguru.com/news/miasma-worm-targets-ai-coding-agents-github-microsoft/
- The CyberSec Guru — Red Hat npm Packages Compromised: Technical Analysis of Miasma Worm (June 1, 2026). https://thecybersecguru.com/news/red-hat-npm-packages-compromised-miasma-worm/
- HackRead — Miasma Malware Hits 32 Red Hat Packages via Compromised GitHub Account (June 2, 2026). https://hackread.com/miasma-malware-red-hat-packages-github-account/
- The Hacker News — IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks (June 5, 2026). https://thehackernews.com/2026/06/ironworm-and-new-miasma-worm-variant.html
Editorial note: The source article’s claim that the attack impacted “73 Microsoft repositories” across four GitHub organizations has been verified across multiple independent sources, as has the 105-second takedown window. The claim that compromised credentials from May “plausibly never fully lost” their access is a researcher assessment, not a confirmed organizational statement from Microsoft or GitHub. The list of affected repositories in the source article is partial; additional repositories confirmed by OpenSourceMalware and other investigators are referenced in the linked sources above.