73 Microsoft GitHub repositories impacted by Miasma malware
Source Reddit Cybersecurity
Discussion
A supply chain compromise involving the Miasma malware affected 73 Microsoft GitHub repositories after initially compromising a Red Hat employee's GitHub account. The malware planted a payload runner directly into multiple public repositories, which executes automatically when cloned and opened in certain AI development tools. The compromised repositories include critical Microsoft projects such as Azure Functions Host and components across multiple programming languages. Red Hat confirmed the compromise originated from unauthorized commits in their GitHub organization and has removed affected package versions from npm. No customer action is currently required as Red Hat's deployment process prevents the malicious code from reaching production environments. The investigation is ongoing.
r/cybersecurity (opens in a new tab)u/ExtensionSuccess85390 points0 comments
The worm initially struck the redhat-cloud-services npm namespace by compromising a Red Hat employee’s GitHub account.
It skipped the npm registry entirely for several targets, planting a payload runner straight into multiple public repos. The dropper then automatically executes when an infected repository is cloned and opened inside AI dev tooling like Claude Code, Gemini CLI and Cursor.
The self-replicating worm fully spread into Microsoft's GitHub orgs. Over 70 repositories are already known to be compromised and subsequently disabled by GitHub. If you click into the below repos you'll still see the same error notification for entire weekend.
This includes core tools like Azure/azure-functions-host and the entire ecosystem surrounding durabletask (spanning .NET, Go, Java, JS, MSSQL, and Python).
Short blog post on the Miasma malware:
https://cloudsmith.com/blog/miasma-worms-path-of-destruction