{"schema_version":"0.10.0","id":"LR-2026-0584","record_version":1,"title":"Miasma worm compromises 73 Microsoft GitHub repositories via AI coding tools","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":56.1,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":4.16,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"de1fe070808aca88d87370acaed848b0375fd5165e669b209c3ec4e8be63a408"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-06-05","date_disclosed":"2026-06-06","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"credential_exposure","duration":null,"detection_method":"unknown","summary":"The system was a set of developer repositories on GitHub, including Microsoft's Azure and Azure-Samples organisations, which developers open in AI coding tools. An attacker used previously compromised contributor credentials to push a malicious commit to the Azure/durabletask repository. The commit added configuration files that ran a credential-harvesting payload when a developer opened the repository in an AI coding tool. The payload harvested credentials and used them to propagate to further repositories. GitHub disabled the affected repositories in an automated sweep lasting 105 seconds. Microsoft said it had temporarily removed some repositories while it investigated. The malicious commit was reportedly backdated and used a skip-ci flag to avoid automated detection.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"Previously compromised contributor credentials were used to push the malicious commit","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":"PT105S","operations_paused":null,"remediation":null,"precursor_events":"Initial compromise of the durabletask PyPI package on May 19, 2026, with three malicious versions uploaded using a compromised publishing token","primary_risk":"RK06","secondary_risks":["RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","harm_class":[],"affected_description":"73 Microsoft repositories across four GitHub organizations (Azure, Azure-Samples, Microsoft, MicrosoftDocs)","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html","publisher":"The Hacker News","date":"2026-06-06","type":"press","title":"Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.rescana.com/post/miasma-worm-supply-chain-attack-73-microsoft-github-repositories-compromised-via-ai-coding-tools","publisher":"Rescana","date":"2026-06-07","type":"press","title":"Miasma Worm Supply Chain Attack: 73 Microsoft GitHub Repositories Compromised via AI Coding Tools - Rescana","archived_url":null}],"per_field_confidence":{"event.date_occurred":"C","event.incident_class":"C","event.trigger":"C","event.root_cause_detail":"C","event.time_to_contain":"C","event.precursor_events":"C","impact.affected_description":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.date_occurred":[{"source_index":1,"quote":"On June 5, 2026, the Miasma worm, a self-replicating supply chain malware, compromised 73 Microsoft GitHub repositories across four major organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs."}],"event.incident_class":[{"source_index":0,"quote":"Microsoft's GitHub repositories have become the latest to fall victim to the ongoing Miasma self-replicating supply chain attack campaign."}],"event.trigger":[{"source_index":1,"quote":"The attack was executed using previously compromised contributor credentials, allowing the attacker to push a malicious commit to the Azure/durabletask repository."}],"event.root_cause_detail":[{"source_index":1,"quote":"The attack was executed using previously compromised contributor credentials, allowing the attacker to push a malicious commit to the Azure/durabletask repository."}],"event.time_to_contain":[{"source_index":1,"quote":"The attack was contained by GitHub within 105 seconds through automated enforcement, but the full scope of downstream impact remains undetermined."}],"event.precursor_events":[{"source_index":1,"quote":"May 19, 2026: Initial compromise of the durabletask PyPI package, with three malicious versions uploaded in a 35-minute window using a compromised publishing token."}],"impact.affected_description":[{"source_index":0,"quote":"The incident impacted 73 Microsoft repositories across four of its GitHub organizations, including Azure, Azure-Samples, Microsoft, and MicrosoftDocs, per OpenSourceMalware."}],"impact.severity":[{"source_index":1,"quote":"The attack was contained by GitHub within 105 seconds through automated enforcement, but the full scope of downstream impact remains undetermined."}],"event.summary":[{"source_index":1,"quote":"The attack was executed using previously compromised contributor credentials, allowing the attacker to push a malicious commit to the Azure/durabletask repository."},{"source_index":1,"quote":"This commit introduced configuration files that triggered a credential-harvesting payload when the repository was opened in AI coding tools such as Claude Code, Gemini CLI, Cursor, and VS Code."},{"source_index":1,"quote":"The worm harvested credentials for cloud platforms and developer tools, then used those credentials to propagate itself to additional repositories."},{"source_index":1,"quote":"GitHub responded by disabling the affected repositories in an automated sweep lasting 105 seconds."},{"source_index":0,"quote":"we have temporarily removed some repositories as we investigate potential malicious content."},{"source_index":1,"quote":"The malicious commit (hash: 5f456b8) was backdated to 2020 and included a misleading message with a [skip ci] flag to evade automated CI/CD detection."}]},"notes_on_gaps":"No source states the date of detection, the root cause category, the adversary's identity or whether it was external, the number of affected third parties as parties, recovery time or direct loss. The sources do not say whether the AI coding agents acted autonomously; the payload ran through session-start hooks and auto-run tasks, so event.agent_involved, failure_class and autonomy_level are left out. The trigger is recorded as credential_exposure because the sources name compromised credentials as the means of access. Severity is major on the unbounded-scope test because the source states the full downstream scope is undetermined. The 'Microsoft confirmed' note on the May 19 event comes from source 1 and is not separately quoted. Source 0 and source 1 both describe the June 5 event; the Rescana timeline is treated as the more detailed record. Dates for the June 5-6 disclosure are a range and are not used as date_disclosed. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The payload harvested credentials and used them to commit the worm into other repositories.","quote":"The worm harvested credentials for cloud platforms and developer tools, then used those credentials to propagate itself to additional repositories.","source_index":1,"grade":"C"},{"step":"caught","text":"GitHub disabled the affected repositories in an automated sweep lasting 105 seconds.","quote":"GitHub responded by disabling the affected repositories in an automated sweep lasting 105 seconds.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html","https://www.rescana.com/post/miasma-worm-supply-chain-attack-73-microsoft-github-repositories-compromised-via-ai-coding-tools"]},"analysis":{"sections":{"timeline":[{"text":"Malicious payload core modules authored and C2 domain git-service[.]com registered.","quote":"May 16, 2026: Malicious payload core modules authored and C2 domain git-service[.]com registered.","source_index":1,"when":"2026-05-16"},{"text":"Initial compromise of the durabletask PyPI package; Microsoft confirmed and removed the packages.","quote":"May 19, 2026: Initial compromise of the durabletask PyPI package, with three malicious versions uploaded in a 35-minute window using a compromised publishing token.","source_index":1,"when":"2026-05-19"},{"text":"Second wave of Miasma-themed dead-drop repositories begins.","quote":"June 3, 2026: Second wave of Miasma-themed dead-drop repositories begins.","source_index":1,"when":"2026-06-03"},{"text":"Malicious commit pushed to Azure/durabletask using the same compromised contributor account.","quote":"June 5, 2026: Malicious commit (5f456b8) pushed to Azure/durabletask using the same compromised contributor account.","source_index":1,"when":"2026-06-05"},{"text":"GitHub disables 73 repositories in two automated waves over 105 seconds.","quote":"June 5, 2026, 16:00:50–16:02:35 UTC: GitHub disables 73 repositories in two automated waves over 105 seconds.","source_index":1,"when":"2026-06-05T16:00:50Z"},{"text":"Public disclosure and technical analysis by security researchers and news outlets.","quote":"June 5–6, 2026: Public disclosure and technical analysis by security researchers and news outlets.","source_index":1,"when":"2026-06-05/2026-06-06"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html","https://www.rescana.com/post/miasma-worm-supply-chain-attack-73-microsoft-github-repositories-compromised-via-ai-coding-tools"]}}