GitHub Purges 70+ Microsoft Repositories Following Miasma Worm Outbreak
Table of Contents
The 105-Second Purge
In a rare and aggressive move, GitHub disabled 73 repositories in just 105 seconds last Friday, June 5, after detecting a rapid-fire infection of the Miasma worm. The purge, which targeted a cluster of Microsoft-owned projects, left developers worldwide staring at “Terms of Service violation” messages and dealing with shattered CI/CD pipelines.
The speed of the takedown suggests that GitHub’s automated detection systems tripped a critical alarm, triggering a scorched-earth response to prevent further propagation. While the immediate effect was the restoration of security, it created an instant operational vacuum for teams relying on those repositories for deployment.
The Entry Point: A Compromised Contributor
According to analysis from Ashish Kurmi, CTO and co-founder of StepSecurity, the contagion began when a compromised contributor account pushed a malicious commit to Azure/durabletask. Rather than a traditional payload, the commit dropped specialized configuration files designed to trigger remote code execution (RCE).
The sophistication of the attack lies in its delivery mechanism. The worm doesn’t require the user to execute a binary; instead, it triggers when a developer simply opens the repository in a modern Integrated Development Environment (IDE) or an AI-powered coding tool. Tools like Claude Code, Gemini CLI, and Cursor—which often automatically parse project configurations to provide context—effectively became the delivery vehicles for the malware.
Collateral Damage in the Pipeline
The fallout was felt most acutely in the automation layer. One of the most critical repositories disabled was Azure/functions-action, a cornerstone for deploying code to the Azure cloud. Because this action is referenced by thousands of GitHub Actions workflows, the sudden disappearance of the repo caused a cascade of failures. Workflows attempting to call Azure/functions-action@v1 simply stopped resolving, effectively freezing deployments for a significant number of enterprise users.
Initially, some developers reported these as generic “internal management issues” in support threads, but the reality was a systemic security intervention to halt the worm’s spread.
The Miasma Lineage and the “Secret-Scouting” Goal
This is not an isolated incident, but rather a recurrence of a broader campaign. The Miasma worm is identified as a descendant of the Mini Shai Hulud worm, a piece of malware that recently impacted the npm registry and Red Hat packages. The original Mini Shai Hulud was open-sourced by the cybercrime group TeamPCP, meaning Miasma could be the work of the same group or a third party utilizing the leaked codebase.
The objective of Miasma is surgical: cloud secret extraction. The worm specifically hunts for developer tool configurations and cloud credentials on Linux systems. This was previously seen on May 19, when the durabletask PyPi package was targeted, with three versions uploaded in a 35-minute window to plant info-stealers on developer machines.
The Token Rotation Failure
The fact that the same durabletask family was targeted again suggests a critical failure in credential hygiene. Kurmi notes that the tokens associated with the compromised account used in the May attack were likely not fully rotated. This oversight provided the attackers a persistent backdoor to push commits to GitHub weeks after the initial breach.
This pattern highlights a growing vulnerability in the modern software supply chain: the reliance on long-lived tokens and the inherent trust AI coding tools place in project configuration files. As these tools become more integrated into the developer workflow, they create new attack vectors that traditional static analysis often misses.
Microsoft has not yet provided an official statement regarding the specific number of compromised accounts or the full extent of the data exfiltrated during the Miasma outbreak.
