It is crucial information for everyone who uses the AI coding tools, such as Claude Code, Cursor, or the command line interface in Gemini. Microsoft had to withdraw over seventy of its own open-source repositories on GitHub due to hacking that installed malware aimed directly at developers working with AI coding tools.
What Happened
On June 5th, 2026, GitHub disabled 73 Microsoft repositories under four organizations, including Azure, Azure-Samples, Microsoft, and MicrosoftDocs. If you try to visit these repositories now, you will be informed that these repos are currently disabled due to the violation of GitHub’s terms of service. Such news is hardly expected when the repositories belong to one of the most significant technology companies in the world.
Microsoft acknowledged disabling these repositories while checking what the company refers to as “potential malicious content”. A spokesperson stated that the organization restored some repositories after checking them out. Some repositories remained disabled for some time. Moreover, Microsoft contacted a limited number of customers who may have downloaded materials from the affected repositories, although they failed to report the amount of data affected.
What Malware Did Microsoft Repositories Suffer From
The malware, referred to as Miasma, belongs to the self-replicating worms. This variant of the malicious software was discovered by security company Cloudsmith and malware analyzer OpenSourceMalware. The worm is an evolution of another malware variant named Mini Shai-Hulud whose source code leaked in mid-May of 2026.
What Malware Did and How It Spread
Hackers used a stolen account credential of a Microsoft contributor and pushed a malicious update of Azure Durable Task repository. They uploaded configuration files that would install a payload as soon as a developer accessed these repositories using an AI coding tool. The payload in the form of a 4.3 MB file activated itself in Claude Code, Gemini CLI, Cursor, VS Code, and npm test scripts. It means that one needed neither to run a command nor click anything dangerous – only accessing the repository via an AI coding tool would be enough.
Then the worm would steal credentials for AWS, Azure, Google Cloud, Kubernetes, npm, and GitHub accounts and use them to upload copies of itself to other repositories of which developers possessed write permissions.
There were several features that could have helped the malware escape detection. First, this worm used legitimate credentials to generate legitimate tokens, and malicious builds contained valid security certificates. Secondly, the malware used legitimate builds that would look absolutely regular from a standard security scanner’s point of view. Besides, the worm produced an individual encrypted payload for every single infection, which nullified the effect of detection based on signature comparison.
Why Were AI Developers the Targets
This was a purposeful attack against AI developers. Hackers took advantage of the fact that developers often work with AI coding tools nowadays. These tools usually read and interpret repositories as soon as developers access them. For this reason, a worm that infects a developer as he or she opens a repository takes advantage of something that did not even exist a year ago. Modern software development does not require developers to run something anymore – they can infect a system only by opening a particular package in a certain tool.
In this way, the malware represents the supply chain infection, adapted to new realities of modern software engineering.
The Problem with Durable Task
The repositories containing azure-functions-host, azure-search-openai-demo, and the entire Durable Task ecosystem for .NET, Go, Java, JavaScript, and Python suffered from the attack.
Interestingly, this was not the first breach affecting open-source repositories of Microsoft – in mid-May, the Durable Task became compromised, apparently by the same group. Now security experts refer to the breach of June as “re-compromise”. According to researcher Paul McCarty, “the repos that were the root cause of the compromise in last month’s breach are among those targeted again. When the repo at the root of last month’s compromise is the hub of this month’s takedown, that is not a coincidence – that is the same wound re-opening”.
GitHub’s Response to Miasma
GitHub’s automated systems managed to detect the extent of the infection and disable all 73 repositories that fell victim to the attack in 105 seconds. That is a record-breaking response time. Nevertheless, the exact number of developers who accessed repositories in question prior to this action remains unknown. So far, Microsoft has not shared detailed information regarding the extent of damage.
A Campaign Worth Looking Out For
The incident discussed above belongs to the broader campaign that attacks the open source ecosystem since December of 2025. Other victims included the Bitwarden, Mistral AI, SAP, TanStack, and even GitHub. Last month, a related attack compromised more than thirty repositories related to cloud solutions developed by Red Hat. Their packages were estimated to receive over 117 thousand downloads per week.
In fact, there is a pattern underlying all of these incidents – steal developer’s credentials to push malware via legitimate channels and use open-source ecosystem as your distributor.
What You Need To Do
If you use Azure tools, contribute to Microsoft open-source projects, or work with third-party repositories using AI coding tools, then you should do the following immediately: rotate your GitHub Personal Access Tokens, SSH keys, CI/CD secrets, and credentials for Azure, AWS, and GCP. Also, you need to check your repositories for any changes and background processes that can be dangerous to your system. Moreover, from now on you should stop trusting always updated versions of open-source packages and control what you insert into your development cycle.
Frequently Asked Questions
Q 1: What is Miasma Worm?
The Miasma worm is a form of self-replicating malware that steals credentials from developers and uses them to inject malware into other code repositories. It is the evolution of a publicly available hacking tool called Mini Shai-Hulud, published by a hacker group in May 2026.
Q 2: How many Microsoft Repositories were impacted?
73 repositories belonging to four Microsoft-owned organizations including Azure, Azure-Samples, Microsoft, and MicrosoftDocs have been shut down by GitHub. Some have been recovered while others remain suspended.
Q 3: Why were AI Coding Tools like Claude Code and Cursor targeted?
They scan repositories upon loading which is a fairly new development in software development practices. The attack vector takes advantage of this fact.
Q 4: What credentials does the Miasma worm steal?
It steals credentials for AWS, Azure, Google Cloud, Kubernetes, npm, and GitHub. With these credentials in hand, it infects any repository with code injection capability from the infected developer.
Q 5: Why didn’t the standard security tools detect the threat?
Because the worm uses actual credentials, valid security certificates, and produces different payloads for each infection, all scanners see this as nothing but a regular update.
Q 6: Is this the first Microsoft compromise by this malware family?
No, Microsoft’s Durable Task project got hacked in mid-May. This suggests that the malware compromised the project again after the initial incident was resolved.
Q 7: How quickly did GitHub act in response?
All 73 impacted repositories were disabled within 105 seconds thanks to automation mechanisms. However, the number of developers affected by downloading malicious code remains unknown.
Q 8: Should I take action if I think I may have been impacted?
You should rotate all the credentials that may be involved including GitHub tokens, SSH keys, CI/CD secrets, and cloud provider authentication credentials. Additionally, you should audit your repositories.
Q 9: Does this mean AI coding tools are unsafe?
Not entirely – AI coding tools are perfectly fine, the problem comes from where you target them. You should use the same caution when opening an unfamiliar code repository that you would for any program.
Q 10: What does this event mean for open-source security?
It exposes a potential flaw in the trust model which is inherent to how open-source software works. You will need stronger controls on code dependency in addition to security tools.
