Microsoft had to shut down 70+ GitHub repos after getting hacked, brings back some

The self-replicating malware campaign known as Miasma took the open-source world by storm. It was reported that almost 73 Microsoft GitHub repositories were infected by the worm and had to be temporarily shut down to determine how attackers compromised projects and stuffed password-stealing malware in the code.

These GitHub repos span across different organizations, including Microsoft Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The malware enabled attackers to steal passwords and credentials when compromised tools were opened in popular AI coding apps, including Claude Code, Gemini CLI, VS Code, and Cursor.

The security firm Cloudsmith, malware analysis site OpenSourceMalware, and 404 Media were among the first to report the hack. For background, Miasma is a variant of the Mini Shai-Hulud worm, open-sourced by the threat group TeamPCP. It started its journey by compromising a Red Hat employee's GitHub account to attack the @redhat-cloud-services npm namespace.

Earlier this month, Microsoft Threat Intelligence reported that the Miasma attackers published 32 malicious packages across more than 90 versions under the @redhat-cloud-services npm scope to steal cloud credentials.

The worm didn't take long to start attacking source repos directly rather than package registries. It is known to skip the npm registry entirely for several targets and plant malicious code straight into public repos like "icflorescu/mantine-datatable." The delivery approach was designed to weaponize AI coding tools.

Miasma's malicious payload embedded into projects can trigger automatic code execution when the infected repo is opened in an AI coding tool or IDE. The list of affected projects includes "durabletask", a Python package compromised by TeamPCP a month earlier to deliver an information stealer designed for Linux systems.

That said, Microsoft has begun restoring some repos affected by the malware campaign, The Hacker News reports. A company spokesperson stated the following:

Our priority is to protect customers and the broader ecosystem. We temporarily removed some repositories as we investigated potential malicious content. Some of these repos have been restored after review, while others may remain offline while work continues.

Microsoft will continue to investigate the attack. It has notified a small number of customers who may have removed their content from the affected repos. The company will reach out to customers again through established support channels "if anything further is identified that requires customer action."