Microsoft Open Source Repositories Compromised by Miasma Worm Malware
Executive Summary
Microsoft has disabled dozens of its open source projects on GitHub after hackers injected password-stealing malware into the code. The attack specifically targeted developers using AI-powered coding tools, such as Claude Code, Gemini's CLI, and VS Code, by stealing sensitive credentials when these tools interacted with the compromised repositories.
The Breach: Miasma Worm and Supply Chain Attack
Security firms Cloudsmith and OpenSourceMalware were among the first to identify the breach, attributing the malware to the "Miasma worm." This incident is classified as a supply chain attack, where attackers compromise a trusted source of code to distribute malware to a wide range of downstream users.
Key details of the breach include:
- Scale of Impact: At least 70 Microsoft projects were disabled by GitHub staff due to terms of service violations following the discovery of malicious content.
- Targeted Tools: The malware was designed to trigger when users opened compromised tools within AI coding applications.
- Affected Ecosystems: The breach impacted projects related to Microsoft Azure and various AI development utilities, including the
homebrew-functionstap.
Microsoft's Response and Remediation
Microsoft confirmed the removal of the repositories to investigate potential malicious content. A company spokesperson, Ben Hope, stated that some repositories have since been restored after review, while others remain offline. Microsoft has notified a small number of customers who may have downloaded content from the affected repositories and will communicate further via established support channels if additional action is required.
Recurring Vulnerabilities and the Durable Task Project
This incident follows a similar breach in mid-May 2026, where the "Durable Task" project—a tool for building applications—was compromised. Security researchers at OpenSourceMalware have described the current incident as a "re-compromise" of the Durable Task project, suggesting that the initial remediation efforts may have failed to fully eradicate the attackers or that a new, distinct breach occurred.
Technical Analysis and Community Insights
Industry experts and the developer community have raised several concerns regarding the technical vectors of this attack:
Credential Management
Developers have pointed out the risk of using "classic" Personal Access Tokens (PATs) over fine-grained tokens. There is a strong recommendation to move toward fine-grained tokens to limit the blast radius of a credential theft attack.
The Role of AI Coding Agents
There is a growing concern that the "Age of Agentic Development" has increased the attack surface. Because AI agents often operate with high levels of permission to automate tasks, they may inadvertently execute obfuscated malicious files that bypass traditional human code review.
Sandboxing and SBOMs
To mitigate these risks, security professionals recommend:
- Sandboxing: Avoiding direct
npm installorpip installon local machines in favor of isolated environments. - Strict SBOMs: Maintaining a strict Software Bill of Materials (SBOM) and implementing a minimum release age policy to prevent the immediate adoption of newly compromised versions of packages.
"The risk of supply chain issue has increased dramatically in the enterprise... now in many places it is encouraged by coders and managers to vibe stuff on their own devices."
Summary of Mitigation Strategies
| Strategy | Purpose | Recommended Action |
|---|---|---|
| Token Rotation | Prevent credential theft | Switch from classic PATs to fine-grained tokens |
| Environment Isolation | Limit blast radius | Use sandboxed environments for package installation |
| Version Pinning | Avoid immediate compromise | Implement a minimum release age policy for dependencies |