Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack (thehackernews.com)

submitted 2 months ago by lemmydev2@infosec.pub to c/pulse_of_truth@infosec.pub

1 comments fedilink hide all child comments

Microsoft's GitHub repositories have become the latest to fall victim to the ongoing Miasma self-replicating supply chain attack campaign.

The incident impacted 73 Microsoft repositories across four of its GitHub organizations, including Azure, Azure-Samples, Microsoft, and MicrosoftDocs, per OpenSourceMalware. The development has GitHub to disable access to those repositories.

"Access to this

you are viewing a single comment's thread
view the rest of the comments

[-] ocasta 8 points 2 months ago* (last edited 2 months ago)

"The commit added no dependencies. It planted a 4.3 MB payload runner and wired it to execute automatically through five developer tools: Claude Code, Gemini CLI, Cursor, VS Code, and the npm test script," SafeDep said. "The attack detonates when a developer clones one of the affected repos and opens it in an AI coding agent. The dropper is the same staged Bun loader, here repurposed for GitHub source-repo persistence rather than registry poisoning."

Based

this post was submitted on 06 Jun 2026

27 points (100.0% liked)

Pulse of Truth

2495 readers

82 users here now

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

Commenting rules:

Be respectful.
No bigotry (including racism, sexism, homophobia, transphobia).
No pornography.
Nothing illegal.
More rules will be added when necessary

founded 2 years ago

MODERATORS

krogoth@infosec.pub