Summary
- Microsoft temporarily removed some GitHub repositories while investigating potential malicious content, according to statements reported by TechCrunch.
- Researchers linked the activity to Miasma, a self-replicating supply chain campaign targeting developer credentials and AI coding workflows.
- The incident expands software supply chain risk beyond package installation into repository-opening behaviour inside AI coding agents and IDEs.
Microsoft temporarily removed some GitHub repositories while investigating potential malicious content, after researchers reported a supply chain campaign targeting Azure-related projects and AI coding workflows.
The activity has been linked by researchers to Miasma, a self-replicating supply chain campaign described as an evolved variant of Mini Shai-Hulud. TechCrunch reported that Microsoft confirmed it had temporarily removed some repositories during its investigation and notified a small number of customers who may have pulled content from affected repositories.
Public detail remains incomplete. Microsoft has not published a full standalone incident report at the time of writing. TechCrunch reported that many affected projects related to Azure and tools used by developers working with AI development apps such as Claude Code, Gemini’s command line interface, and VS Code. It also cited Cloudsmith and OpenSourceMalware as early sources identifying the malicious activity.
Cloudsmith said the Miasma campaign had spread from earlier open source package compromises to 73 Microsoft GitHub repositories across environments including Azure and Durable Task. StepSecurity separately reported that GitHub disabled 73 repositories across four Microsoft GitHub organisations after a malicious commit was pushed to the Azure/durabletask repository using a previously compromised contributor account.
The reported technique moves beyond the familiar package-registry model. Instead of waiting for a malicious dependency to be installed through npm, PyPI, or another package manager, researchers say the campaign planted configuration files designed to execute a credential-harvesting payload when a developer opened the repository in certain AI coding tools or IDE workflows.
AI coding agents are increasingly integrated into development environments that have access to local files, source repositories, terminals, credentials, cloud configuration, and internal code context. If a repository can carry hidden instructions or configuration capable of triggering tool behaviour, the development environment becomes an execution and exfiltration surface rather than a passive workspace.
Cloud and software teams often hold tokens with reach into production pipelines, package registries, source control, CI/CD systems, infrastructure-as-code repositories, and customer-facing services. A stolen developer token can become a route into release processes, cloud accounts, internal documentation, or other repositories. AI-assisted development adds further trust decisions around what tools can read, execute, and connect to on behalf of the user.
The Microsoft connection raises the profile of the campaign, although the underlying issue applies across enterprise software development. Many organisations have encouraged developers to adopt AI-assisted coding to accelerate delivery. Governance controls have often focused on data leakage into AI providers, licensing risk, model quality, and generated-code security. Repository-borne instructions that target the agent or IDE create a different control problem.
Useful defences will not be purely tool-specific. Organisations need stronger repository trust policies, signed commits and provenance checks where appropriate, tighter token scopes, isolated development environments, secrets that cannot be read trivially from local configuration, and monitoring for unusual repository, package, and cloud access. AI coding tools also need to sit inside the software delivery control plane, with the same discipline applied to build systems, CI/CD platforms, and privileged developer workstations.
The number of affected customers, the exact route into the repositories, the full list of impacted projects, and the extent of any credential theft remain unclear. The confirmed repository removals and customer notifications, combined with the research findings, show software supply chain risk extending from what developers install to what their AI-enabled tools interpret, execute, and connect to during ordinary development work.
