Miasma Self-Replicating Worm Reaches Microsoft GitHub Orgs, 73 Repos Affected

Key points

• A self-replicating worm campaign tracked as Miasma hit 73 Microsoft repositories across four GitHub organizations.
• GitHub has disabled access to every affected repository.
• The worm spreads by using a compromised maintainer's credentials to push tainted code to any repo they can write to.
• No vendor has publicly attributed Miasma to a known threat actor; criminal-opportunistic remains the working assumption.
• Defenders who pulled from the affected organizations before the takedown should treat those artifacts as suspect.

What happened to Microsoft's GitHub repositories?

Miasma, a self-replicating supply chain campaign, reached Microsoft's GitHub presence and infected 73 repositories across four organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs. GitHub has since disabled access to all of them. Visitors hitting the affected URLs now see an access-disabled notice rather than the project tree.

We first covered Miasma on 2 June 2026, when it hit Red Hat's npm packages. Its arrival inside Microsoft-controlled organizations marks a significant escalation in scope.

How does the worm spread?

Miasma seeds malicious code into a developer's repositories or packages, then uses that developer's stored credentials and tokens to push outward to every repo they can write to. Each compromised maintainer becomes the launch point for the next wave. That mechanic almost certainly explains how it reached Microsoft-controlled organizations: a maintainer or service account with write access to those orgs, not a direct intrusion into Microsoft infrastructure.

The propagation model overlaps with Shai-Hulud npm worm activity reported earlier this cycle, which similarly chained stolen tokens into onward publishing. Whether Miasma is derived from that tooling or is a parallel development isn't resolved. Attribution to any known cluster remains open, and medium confidence is the ceiling on motivation right now.

The token-theft angle is worth reading alongside our 3 June story on how a single VS Code click could surrender a GitHub token, which documented exactly the kind of credential exposure Miasma's propagation depends on.

Should you worry if you use these repositories?

Yes, if your build pipeline pulled from any of the four affected organizations before GitHub's takedown. Treat those artifacts as suspect. Rebuild from a known-clean commit once Microsoft republishes, and audit GitHub Actions logs for unexpected workflow runs or outbound calls to unfamiliar domains. Rotate any PATs and deploy keys that touched the affected repos.

GitHub's takedown blunts further pull-based propagation. It doesn't help anyone who already cloned or installed tainted commits.

What's the structural problem here?

Worming behavior inside developer platforms collapses the time between initial compromise and ecosystem-wide blast radius. The Microsoft incident makes that concrete: 73 repositories across four organizations, reached not by breaking Microsoft's perimeter but by walking through a door a legitimate maintainer had left open. Token-scoped permissions and short-lived credentials aren't optional hygiene for maintainers of widely-consumed projects.

Microsoft hasn't published a formal advisory at MSRC covering this incident. GitHub's security advisories database is the place to watch for per-repository CVEs if any injected payloads warrant one.

The count of 73 repositories across four organizations will likely move as the investigation matures. Worms are messy that way.