The Miasma Worm Walked Back Into Microsoft GitHub

GitHub disabled 73 Microsoft repositories in 105 seconds on June 5, 2026, after the Miasma worm planted a credential stealer in Azure’s own code. The sweep covered Azure, Azure-Samples, microsoft, and MicrosoftDocs, and every disable timestamp fell between 16:00:50 and 16:02:35 UTC.

Seventeen days earlier, three poisoned versions of the same Durable Task project had already shipped to PyPI. Microsoft later restored the GitHub repos and told a small number of customers they may have pulled the bad code. The credential that opened the door the first time was still useful the second time.

73 Repos, Four Orgs, 105 Seconds

Paul McCarty, who runs the OpenSourceMalware threat database, logged 73 repositories across four organizations, all flagged tos. That is GitHub’s automated abuse switch, not a person clicking through a list. Azure took the hit: 49 repos, essentially what the Functions team ships, including the host, language workers, both deploy actions, and the Homebrew tap.

WHERE THE 73 REPOS SAT

The microsoft org lost the whole Durable Task family in the same window as Azure/durabletask itself. Azure-Samples lost a row of AI starter apps that new Azure customers clone when they learn retrieval-augmented search and multi-agent workflows. MicrosoftDocs lost windows-driver-docs, which is not a Functions repo at all, a sign the cut followed org ownership rather than one team’s file tree.

Ashish Kurmi, co-founder and CTO of StepSecurity, said the June push started from a compromised contributor account on Azure/durabletask. Researchers tracking the campaign said the commit was backdated toward 2020, carried a [skip ci] flag so Actions would stay quiet, and added no real source change behind a DataConverter message.

The May Token Was Still Live in June

On May 19, 2026, three malicious versions of Microsoft’s official durabletask package on PyPI, tagged 1.4.1, 1.4.2, and 1.4.3, went up in a 35-minute window. OpenSourceMalware put typical traffic for that SDK at about 417,000 downloads a month. Wiz, Endor Labs, and StepSecurity tied the publish to stolen GitHub Actions secrets and to TeamPCP. PyPI yanked the versions within hours. There were no matching tags, releases, or CI runs on the GitHub side.

On June 2, Microsoft Threat Intelligence published its own write-up of the Miasma campaign against Red Hat packages, 32 packages under the @redhat-cloud-services npm scope, published through a legitimate GitHub Actions OpenID Connect workflow so the bad builds carried real provenance signatures. The campaign marker on those packages was “Miasma: The Spreading Blight.” Three days later, GitHub’s abuse engine turned off Microsoft’s own Durable Task tree.

THE SAME WOUND, THREE WEEKS

1. May 19, 2026: Three durabletask versions land on PyPI with no GitHub tags and are yanked within hours.
2. June 2, 2026: Microsoft Threat Intelligence details Miasma on Red Hat npm, including a 4.29 MB preinstall dropper.
3. June 3, 2026: The same worm family forges commits into five public repos belonging to Ionut-Cristian Florescu in 49 seconds.
4. June 5, 2026: GitHub disables 73 Microsoft repos in 105 seconds, with Azure/durabletask at the center of the cluster.
5. June 8, 2026: A Microsoft spokesperson says repos were removed over potential malicious content; the company later said all of them were restored after review.
6. August 26, 2026: Australian Federal Police, with FBI help, arrest a 21-year-old later named in a U.S. TeamPCP indictment.

Nilesh Jain, co-founder of CleanStart, put the operational reading in one line: the durabletask PyPI token was compromised in May, and the same account was used to push the June commits, which means rotation after the first incident was incomplete or the attacker kept a foothold that nobody caught. McCarty wrote the same conclusion from the repo map.

When the repo at the root of last month’s compromise is the hub of this month’s takedown, that is not a coincidence, that is the same wound reopening. Whoever held those credentials in May plausibly never fully lost them.

Paul McCarty, OpenSourceMalware

Opening the Folder Ran the Stealer

The June payload did not need npm install. Florescu decrypted a 4.3 MB obfuscated file at .github/setup.js from his own repos and showed it was wired to run when a developer opened the project in VS Code, Claude Code, Cursor, or Gemini, or ran npm test. Cloning stayed inert. Opening the folder was the detonation.

Researchers tracking the campaign found matching config files for those tools: a Claude Code SessionStart hook, a Gemini CLI hook with the same shape, a Cursor rule marked alwaysApply, a VS Code task set to run on folder open, and a hijacked test script. Visual Studio Code’s own task schema says a runOn value of folderOpen will run when the containing folder is opened. That is a documented editor feature, not a hole in npm.

THE FIVE AUTO-RUN PATHS

• Claude Code: A SessionStart hook runs a command when a new session opens in the project directory.
• Gemini CLI: A matching SessionStart hook fires on the same open-folder moment.
• Cursor: A project rule with alwaysApply set tells the agent to run the setup script.
• VS Code: A tasks.json entry with runOn set to folderOpen starts as soon as the folder loads.
• npm test: A poisoned test script catches anyone who never opens an AI agent and still runs the suite.

Once it ran, the Bun-based worm hunted tokens for AWS, Azure, GCP, Kubernetes, npm, and GitHub, then used whatever it stole to commit itself into other repos the victim could write. FalconFeeds.io said the trick is the trust model those platforms are built on: if a package is signed with a valid key and published by an authenticated maintainer, it is treated as safe. The worm takes the key and the maintainer, then behaves like a normal publisher.

What Broke for Azure Functions Pipelines

Most of the 49 Azure repos were painful. One of them stopped other people’s production deploys. Azure/functions-action is the Action that runs inside outside pipelines, and the floating @v1 tag means whatever GitHub serves for that name is what runs. When GitHub disabled the repo, every workflow still pointing at Azure/functions-action@v1 stopped resolving.

Developers said so before Microsoft did. A Microsoft Learn thread opened on June 5 reported that the Azure Functions Action went dark, and more than ten engineers piled in with the same broken builds. A pinned commit SHA would have failed in a way a pipeline can see. A floating tag just vanished.

Microsoft’s first reply on that thread guessed at policy violations (malware, phishing, copyright, abuse, or export controls), then, twelve minutes later, called it an internal management issue and told customers to deploy with Azure CLI, Azure DevOps Pipelines, VS Code, Zip Deploy, or Azure Pipelines instead of GitHub Actions. The banner on the repo still said GitHub Staff had disabled access for a terms of service violation.

Microsoft Called It an Internal Management Issue

GitHub’s public notice did not say malware. It did not tell anyone who had cloned an Azure sample that week to assume their laptop was burned. It invited the repo owner to contact Support. Microsoft did not raise “potential malicious content” until June 8, three days after the 105-second sweep.

Our priority is to protect customers and the broader ecosystem. We temporarily removed some repositories as we investigated potential malicious content. All of these repos have been restored after review. As part of our investigation, we notified a small number of customers who may have pulled down content from the affected repositories.

Microsoft spokesperson, June 2026 statements

The company said it would keep investigating and would reach customers through normal support channels if anything else required action. It did not say how many developers opened an affected folder in Claude Code, Cursor, Gemini CLI, or VS Code during the live window, and it did not say whether the May PyPI token had been rotated, replaced, or left sitting.

That gap is the part that still sits on every Azure sample clone. A Functions Action outage is visible because builds go red. A SessionStart hook that ran on a laptop on June 4 never opens a ticket. The people who needed the warning were the ones already told, on a Learn thread, that this was an internal management issue.

Why Smaller GitHub Repos Stayed Live

Florescu maintains mantine-datatable and related Mantine libraries from Bucharest. On the night of June 3, an identical malicious commit, message chore: update dependencies [skip ci], landed in five of his public repos in 49 seconds, with the author forged as github-actions. The commits were unsigned. About five and a half hours later he got GitHub’s password-changed mail, then found the account suspended for a terms of service violation.

He decrypted the same 4.3 MB runner Microsoft’s cluster carried. His npm tokens were already expired, so no package went out poisoned. The payload stayed downloadable from his public trees while he sat locked out. GitHub Support sent one reply asking him to secure his email. Microsoft’s 73 repos were already dark.

Florescu wrote that GitHub disabled those, while his remained live and he remained locked out. He also wrote that the same fingerprint showed up across more than 120 repositories spanning dozens of accounts. SafeDep had already found the worm skipping npm entirely and committing straight into source, including icflorescu/mantine-datatable and four related projects. GitHub’s 105-second machine is real. It is also selective. The owner’s org gets the mass disable. A sixteen-year account with a live stealer waits in the support queue.

Two Arrests in Perth Leave the Worm Family Intact

On August 26, 2026, the Australian Federal Police, working with Western Australia police and the FBI, arrested two men in Western Australia over TeamPCP supply-chain crimes. The U.S. Attorney’s Office for the Northern District of California unsealed a federal indictment of Ruben Ian Thomson the next day. Thomson, 21, a national of Australia and South Africa, is charged with conspiracy to commit Computer Fraud and Abuse Act violations and with obtaining information from a protected computer, tied to Spring 2026 attacks under the TeamPCP name. An indictment is an allegation. He is presumed innocent.

U.S. Attorney Craig H. Missakian said the charged conduct includes injecting malicious code into trusted software tools, then stealing data from downstream customers and, in some cases, demanding ransom. The Australian Federal Police said the pair’s malware may have reached more than 1,000 organizations. Microsoft Threat Intelligence was still picking Miasma runtimes out of npm in July, including an AsyncAPI compromise on July 14 in which harvest and propagation modules were present in the build and switched off.

The June 5 Microsoft takedown is over. The repos are back. The customers Microsoft chose to email have been emailed. The editor feature that runs a task when a folder opens is still in the VS Code schema, and the May durabletask publish still reads as a token that was good for a second trip. That is the wound the 105-second sweep closed on GitHub’s front page and did not close in the credential store.

Frequently Asked Questions

How Did the Miasma Worm Run in VS Code?

VS Code’s task schema sets runOn to default unless a repo overrides it, and default means the task runs only from the Run Task command. The worm wrote runOn as folderOpen, which the same schema defines as a task that starts when the containing folder is opened, so the 4.3 MB runner executed before any install step and without a separate prompt beyond trusting the folder.

What Campaign Marker Did Miasma Leave on Red Hat Packages?

Microsoft Threat Intelligence said the trojanized @redhat-cloud-services packages carried authentic provenance signatures and embedded the campaign marker “Miasma: The Spreading Blight,” the same family name later used for the GitHub-side Microsoft disable on June 5.

What U.S. Penalties Does the TeamPCP Indictment List?

The Northern District of California said that if convicted, Thomson faces a maximum of 5 years in prison and a fine of $250,000, or twice the gross gain or twice the gross loss, for each charged violation of the conspiracy count and the obtaining-information count, with the sentence set by the court under the U.S. Sentencing Guidelines.

Which Homebrew Tap Went Down With Azure Functions?

OpenSourceMalware listed homebrew-functions among the 49 Azure repos disabled in the 105-second window, so anyone installing Azure Functions Core Tools through that Homebrew tap lost the upstream formula at the same moment functions-action stopped resolving in GitHub Actions.