73 Microsoft GitHub Repositories Disabled in 105-Second Sweep; Cause Unclear
Summary
Seventy-three Microsoft GitHub repositories were disabled within 105 seconds, disrupting workflows using Azure Functions actions. Microsoft cited an internal management issue; a connection to the Miasma worm is unconfirmed.
Key points
- The repositories spanned Microsoft's Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations and were disabled between 16:00:50 and 16:02:35 UTC on June 5, 2026.
- The shutdown included Azure Functions actions, breaking workflows that referenced the floating Azure/functions-action@v1 tag.
- Microsoft said the Azure/functions-action repository was disabled because of an internal management issue and recommended alternative deployment methods while it was investigated.
- The article links the event to the Miasma worm only as a possibility. Miasma was reported to have added Azure and GCP credential collection, but its confirmed June 1 infection involved Red Hat npm packages, not Azure.
- The article notes that malicious durabletask PyPI versions were reported in May and attributed by security firms to stolen GitHub Actions secrets and TeamPCP; it does not establish that those events caused the repository shutdown.
- Recommended precautions include pinning GitHub Actions to full commit SHAs, rotating accessible credentials, checking for suspicious public repositories and install hooks, and using alternative deployment methods until actions are restored.
Article Details
- Event Type
- GitHub disabled 73 repositories across four Microsoft organizations in a 105-second window on June 5, 2026, amid an investigation into an internal management issue and possible connection to a prior compromise.
- Impact
- The disabling of Azure/functions-action and functions-container-action disrupted GitHub Actions workflows that depended on them. The article links the event to the earlier compromise of the durabletask PyPI package, but says a connection to the June 5 sweep is circumstantial and unconfirmed.
People
Threat Actors
Malware
ChainDropIn May, TeamPCP open-sourced the Mini Shai-Hulud toolkit — turning a tier-one supply chain weapon into something any motivated copycat can run. On June 1, Aikido and OX Security disclosed the first big result: Miasma, aMiasmaany motivated copycat can run. On June 1, Aikido and OX Security disclosed the first big result: Miasma, a rebrand of Mini Shai-Hulud that infected 32 packages across the @redhat-cloud-services npm namespace.
Vendors
GitHubSometime on June 5, Microsoft's own repositories started going dark on GitHub. Visit a long list of them right now and you don't get code — you get a gray box: "This repository has been disabled. Access to thisMicrosoftSometime on June 5, Microsoft's own repositories started going dark on GitHub. Visit a long list of them right now and you don't get code — you get a gray box: "This repository has been disabled. Access to thisRed HatAnd the limits of the theory: the worm's confirmed June 1 hit was Red Hat's npm packages, not Azure — connecting it to this June 5 sweep is circumstantial until someone gets inside those repos. But it is the worm we
Products
Azure CLIunder investigation, alternative deployment methods are recommended during this period such as Azure CLI, Azure DevOps Pipelines, VS Code deployment, Zip Deploy, or Azure Pipelines instead of GitHub Actions."GitHub Actionsor CI runs in the GitHub repo. Wiz, Endor Labs, and StepSecurity all traced it back to stolen GitHub Actions secrets and tied it to TeamPCP. The packages were yanked within hours.PyPIThis is a re-compromise. On May 19, three malicious versions (1.4.1, 1.4.2, 1.4.3) of the durabletask PyPI package — Microsoft's official Azure Durable Task SDK, pulling roughly 417,000 downloads a month — were