cyber.hendryadrian.com
Security News · opensourcemalware.com

Podcast Examines Miasma Worm’s Microsoft GitHub Attack and Software Supply-Chain Defenses

· Original article ↗

Summary

The episode discusses a Miasma worm attack that disabled 73 Microsoft GitHub repositories, VS Code’s two-hour extension update delay, npm 12’s planned install restrictions, and package firewall tradeoffs.

Key points

  • The hosts report that the Miasma worm disabled 73 repositories across four GitHub organizations in 105 seconds on June 5; Azure Functions GitHub Actions failures disrupted production CI jobs.
  • They say the attack may trace to a May 19 compromise of the Durable Task repository, with attackers reportedly retaining access through stolen credentials; Microsoft had not issued an official account by the episode date.
  • VS Code introduced a two-hour delay for third-party extension auto-updates, limited to the Microsoft Marketplace; the hosts note it does not appear to cover OpenVSX.
  • The NX Console compromise was detected by its maintainers through Marketplace email notifications, not Microsoft detection; OpenVSX required a manual check and removal.
  • npm 12 is planned to disable lifecycle scripts, direct Git dependencies, and remote tarball dependencies by default, but legitimate packages may break and adoption depends on developers and CI systems upgrading.
  • Package firewalls can block known or suspected malicious packages before installation; coverage depends on design and data freshness, and simple command aliases can be bypassed.

Article Details

Event Type
Open-source software supply-chain compromise, with related security-policy changes discussed
Impact
The Miasma worm compromise resulted in 73 Microsoft GitHub repositories being disabled across four GitHub organizations. The affected Azure Functions GitHub Actions caused production CI jobs that called them to fail around the world. Threat actors reportedly used stolen credentials to maintain persistence after an earlier compromise of the Durable Task repository. The episode also covered VS Code extension update delays and npm’s planned default restrictions on install scripts and certain dependency sources.

MITRE ATT&CK

T1078 · Valid AccountsThreat actors reportedly used credentials stolen during the earlier Durable Task repository compromise to maintain persistence before the later activity.

Malware

MiasmaMiasma Worm Hits Microsoft — On June 5th, 73 Microsoft GitHub repositories were disabled within 105 seconds after being compromised by the Miasma worm. Four GitHub organizations were affected, including the AzureMiniShai Huludabout what happened or the impact it caused. The Miasma worm is based on TeamPCP’s open-sourced MiniShai Hulud worm, and the person who open-sourced this newer version appears to be a quasi-security researcher

Vendors

Eclipse Foundationonly to the Microsoft VS Code Marketplace and does not appear to extend to OpenVSX, which the Eclipse Foundation runs separately and which has no equivalent proactive scanning. The NX Console compromise is aMicrosoftMiasma Worm Hits Microsoft — On June 5th, 73 Microsoft GitHub repositories were disabled within 105 seconds after being compromised by the Miasma worm. Four GitHub organizations were affected, including the Azure

Products

Azure Functionsafter being compromised by the Miasma worm. Four GitHub organizations were affected, including the Azure Functions GitHub org, which meant that production CI jobs calling official Azure Functions GitHub ActionsGitHubMiasma Worm Hits Microsoft — On June 5th, 73 Microsoft GitHub repositories were disabled within 105 seconds after being compromised by the Miasma worm. Four GitHub organizations were affected, including the Azurenpmnpm v12 Disables Install Scripts and Dynamic Dependencies — npm announced that version 12 will disable install lifecycle scripts (pre, post, and install), direct Git dependencies, and remote tarball dependencies byOpenVSXThe change also applies only to the Microsoft VS Code Marketplace and does not appear to extend to OpenVSX, which the Eclipse Foundation runs separately and which has no equivalent proactive scanning. The NXVS CodeVS Code Extension Auto-Update Cooldown — VS Code shipped a two-hour auto-update delay for third-party extensions in response to community requests, citing the frequency of extension compromises. The two-hour window is

Related Articles