GitHub Disabled 70+ Microsoft Repos After Miasma Supply-Chain Malware Hit AI Dev Tools

GitHub disabled more than 70 Microsoft-owned repositories after detecting a suspected Miasma worm campaign that inserted malicious code into open source projects and disrupted dependent CI/CD workflows. Researchers said the incident began with a compromised contributor account pushing a malicious commit to Azure/durabletask, adding configuration files that could trigger remote code execution when developers opened the repository in IDEs or AI coding tools including Claude Code, Gemini CLI, and Cursor. Microsoft’s response was unusual because it shut down its own repositories rather than only removing the offending content, and GitHub reportedly disabled 73 repositories in rapid succession after automated detections fired.

The activity appears tied to a broader supply-chain operation linked to earlier compromises of Microsoft’s durabletask PyPI package and to a newer campaign tracked by StepSecurity as Hades, which it describes as an evolution of Miasma. StepSecurity said the malware uses obfuscated Python import hooks to fetch additional payloads, scrape memory across Linux, macOS, and Windows, steal cloud and developer credentials, abuse GitHub Actions and OIDC/Sigstore workflows, move laterally over SSH/SCP, and backdoor IDE and AI assistant configuration files. The campaign also reportedly uses GitHub-based command-and-control and includes a token-monitoring component that can trigger a destructive wiper if a stolen GitHub token is revoked, underscoring the risk to software supply chains and AI-assisted development environments.