Miasma Self-Replicating Worm Reaches Microsoft GitHub Orgs, 73 Repos Affected

A self-replicating supply chain campaign tracked as Miasma has reached Microsoft's GitHub footprint, hitting 73 repositories across four organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs.

GitHub has since disabled access to the affected projects.

The campaign was flagged by researchers at OpenSourceMalware, who have been tracking Miasma's spread across the npm and GitHub ecosystems. Attribution to a specific cluster remains open. No vendor has publicly tied Miasma to a known actor like Lazarus subclusters previously seen abusing npm, and treating this as criminal-opportunistic activity is reasonable until more telemetry surfaces. Medium confidence at best on motivation.

What is clear is the propagation model.

Miasma behaves as a worm. It seeds malicious code into a developer's repositories or packages, then uses that developer's credentials and tokens to push to additional repos they can write to. Each compromised maintainer becomes a launch point for the next wave. That mechanic is what carried it into Microsoft-controlled organizations — almost certainly via a maintainer or service account with write access to those orgs, rather than a direct intrusion into Microsoft infrastructure.

The TTPs overlap with the Shai-Hulud npm worm activity reported earlier this cycle, which similarly chained stolen tokens into onward publishing. Whether Miasma is a fork, a copycat, or shared tooling is unresolved.

GitHub's response was to lock the impacted repositories. Visitors hitting affected URLs see an access-disabled notice rather than the project tree. That blunts further pull-based propagation but does not help downstream consumers who already cloned or installed tainted commits.

For defenders, a few practical notes.

If your build pipeline pulled from any Azure, Azure-Samples, Microsoft, or MicrosoftDocs repository in the window before GitHub's takedown, treat those artifacts as suspect and rebuild from a known-clean commit once Microsoft republishes. Audit GitHub Actions logs for unexpected workflow runs, secret exfiltration patterns, and outbound calls to unfamiliar domains. Rotate any PATs, deploy keys, or OIDC-issued credentials that touched the affected repos.

The broader concern is structural. Worming behavior inside developer platforms collapses the time between initial compromise and ecosystem-wide blast radius. Token-scoped permissions, mandatory 2FA on publish, and short-lived credentials are no longer optional hygiene for maintainers of widely-consumed projects.

Microsoft has not yet published a formal advisory at MSRC covering this specific incident. GitHub's security advisories database is the place to watch for per-repository CVEs if any of the injected payloads warrant one.

The count — 73 repos, four orgs — will likely move as the investigation continues. Worms are messy that way.