Automated detection systems took down compromised repos in under two minutes, but not before breaking Azure deployment workflows across the platform.
Summary
- GitHub disabled 73 Microsoft repositories in 105 seconds after detecting Miasma worm infections on June 5
- Attack began with compromised contributor pushing malicious commit to Azure/durabletask that executed code when opened in IDEs
- Azure/functions-action repo takedown broke CI/CD pipelines for workflows using the popular deployment tool
- Attack appears connected to previous Miasma worm incident targeting Microsoft’s PyPi packages in May
- Same worm compromised 50+ npm packages two days earlier, including SDK with 408,000 monthly downloads
Rapid Response to Repository Compromise
GitHub’s automated detection systems moved swiftly on Friday, June 5, disabling 73 Microsoft repositories within 105 seconds after identifying signs of Miasma worm infections. The takedown occurred in two separate waves, with the platform’s alarms triggering after detecting malicious activity in Microsoft’s open source projects.
Supply Chain Attack Vector
The attack began when a compromised contributor account pushed a malicious commit to the Azure/durabletask repository. According to StepSecurity’s analysis, the commit contained configuration files designed to trigger remote code execution when developers opened the repository in integrated development environments or AI coding tools including Claude Code, Gemini CLI, and Cursor.
Immediate Operational Impact
The repository takedowns created immediate disruption for development teams. The Azure/functions-action repository, used for deploying code to Azure services, was among those disabled. Every workflow referencing Azure/functions-action@v1 stopped resolving, breaking CI/CD pipelines across the platform. Developers reported issues within hours, though GitHub initially described the problems as “an internal management issue.”
Connection to Previous Attacks
The targeting of durabletask suggests links to earlier Miasma worm activity. Microsoft’s durabletask PyPi package was compromised on May 19 in a separate attack that planted infostealers on developers’ machines, specifically targeting cloud secrets and developer tool configurations on Linux systems. The repeated targeting indicates either incomplete token rotation from the previous incident or successful re-compromise through the worm’s propagation mechanisms.
Broader Threat Landscape
Miasma represents an evolution of supply chain attacks, described by security firm Snyk as a descendant of the Mini Shai Hulud worm that previously targeted npm registry packages. Two days before the Microsoft attack, the same worm compromised over 50 npm packages, including a Vapi.ai SDK with more than 408,000 monthly downloads. While cybercrime group TeamPCP claimed responsibility for developing Mini Shai Hulud and open-sourced the code, attribution for Miasma remains unclear.
Why it matters
This incident demonstrates how supply chain attacks can rapidly cascade through development infrastructure, breaking CI/CD pipelines and potentially exposing secrets across multiple environments. The speed of automated detection helped limit exposure, but the attack’s connection to previous incidents suggests persistent threat actor access that could enable future compromises of widely-used development tools and cloud deployment systems.
What to do now
- Review access controls and rotation procedures for contributor accounts with repository access
- Implement monitoring for unusual commits or configuration file changes in critical repositories
- Assess CI/CD pipeline dependencies on external repositories for single points of failure
- Verify that tokens and credentials from previous security incidents have been fully rotated
