Microsoft's GitHub Repositories Disabled Due to Malware Concerns
GitHub disables Microsoft repos pushing password-stealing malware

Image: Bleepingcomputer
Microsoft removed 73 GitHub repositories on June 5 due to suspected malware distribution linked to the Miasma supply-chain campaign. The incident caused disruptions in Azure functions, but all repositories have since been restored and deemed safe. Microsoft is investigating further.
- 0173 repositories were removed from Microsoft’s organizations on GitHub, disrupting Azure functions.
- 02The incident was linked to the Miasma malware campaign, which previously affected Red Hat's npm packages.
- 03Microsoft stated the repositories were disabled due to potential malicious content and an internal management issue.
- 04The compromised 'durabletask' package had previously distributed malicious versions on the Python Package Index.
- 05Developers are advised to lock project dependencies and test builds in isolated environments to enhance security.
Advertisement
In-Article Ad
On June 5, Microsoft took down 73 repositories across its GitHub organizations, including Azure and MicrosoftDocs, due to concerns over potential malware distribution linked to the Miasma supply-chain campaign. This swift action, which lasted only 105 seconds, disrupted continuous integration pipelines and caused outages for developers relying on the 'Azure/functions-action' GitHub Action. Microsoft confirmed that the repositories were disabled because of an internal management issue and ongoing investigations into the presence of malicious content. Researchers noted that the 'durabletask' repository had been compromised earlier in May, allowing the threat actor to exploit it again. Although all repositories have been restored and are now considered safe, Microsoft has notified a small number of customers who may have downloaded content from the affected repositories. The incident underscores the ongoing risks associated with supply-chain attacks in open-source ecosystems, prompting security experts to recommend practices such as locking dependencies and testing in isolated environments to mitigate future threats.
Advertisement
In-Article Ad
The removal of the repositories disrupted developers' workflows, particularly those utilizing Azure functions.
Advertisement
In-Article Ad
Reader Poll
How concerned are you about software supply chain security?
Connecting to poll...
More about Microsoft
Read the original article
Visit the source for the complete story.







