A self-replicating worm has planted credential-harvesting code inside 73 Microsoft GitHub repositories — the most significant escalation yet in an active supply chain attack campaign.
GitHub disabled repositories across four Microsoft organizations — Azure, Azure-Samples, Microsoft, and MicrosoftDocs — after the worm known as Miasma embedded malicious code designed to steal developer credentials. The attack was already spreading through the broader open-source ecosystem before it reached Microsoft. GitHub moved to contain it, but the repositories had been compromised before the platform intervened.
The irony is hard to ignore: Microsoft owns GitHub, and its own flagship Azure tooling and documentation repos became vectors in the exact type of attack GitHub sells security features to prevent. Developers who cloned or pulled from those repositories before the takedown may have already executed the payload locally. Supply chain attacks work because they subvert trust — once a canonical-looking repository is compromised, every downstream project that depended on it is a potential exposure point.
Miasma was already circulating through open-source infrastructure before it reached Microsoft's orbit. If a campaign of this scale can work its way up to repositories that millions of developers treat as authoritative, auditing what you have already pulled is no longer a theoretical exercise.