Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
Summary: The Miasma self-replicating supply chain worm compromised 73 Microsoft GitHub repositories across the Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations, prompting GitHub to disable access to them. StepSecurity reported that the same contributor account behind the May 2026 compromise of the durabletask PyPI package was used to push a malicious commit that plants configuration files triggering automatic code execution when a repository is opened in an AI coding tool or IDE.
Bottom line: The worm needs no vulnerability in npm or GitHub: it compromises a maintainer's key and then publishes exactly as a legitimate maintainer would, so every malicious publish is indistinguishable from a routine update to the registry. The same contributor account from May's durabletask compromise was used again, which StepSecurity says means either its credentials were never fully rotated after May 19 or it was re-compromised by the worm's own propagation loop.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026