Miasma worm compromises 73 Microsoft GitHub repos in supply chain attack

Affected Systems

73 Microsoft GitHub repositories across four organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs. GitHub has disabled access to affected repositories.

Exploitation Status

Active exploitation confirmed. Self-replicating worm (Miasma) has successfully compromised repositories. GitHub has taken containment action by disabling repository access.

Business Impact

High-severity supply chain attack targeting Microsoft's official repositories. Organizations using code, samples, or documentation from these repos may have pulled compromised artifacts. Potential for downstream infections if malicious commits were cloned or dependencies were consumed. Scope of code injection and persistence mechanisms unknown. No CVE assigned yet.

Urgency

🔴 Immediate

Recommended Actions

• Audit all dependencies and code pulled from Microsoft GitHub repositories (Azure, Azure-Samples, Microsoft, MicrosoftDocs) in the past 30 days
• Review git commit history for unexpected changes in local clones of affected repositories
• Scan build pipelines and CI/CD systems for signs of Miasma worm artifacts or unauthorized code execution
• Monitor GitHub security advisories and Microsoft Security Response Center for official guidance and list of affected repositories
• Implement repository integrity checks and pin dependencies to known-good commit hashes until Microsoft confirms remediation