Vulnerabilities · 97 days ago
A repo takedown is only half a cleanup when downstream builds already trusted what was there. Here, the immediate damage was CI breakage, but the deeper risk is that Microsoft-owned repo history may still carry residue from the earlier compromise, so restoring access does not automatically restore trust.
Microsoft disabled 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations after the Miasma/Shai-Hulud supply-chain campaign, then restored some of them while the investigation continued. The disruption hit workflows that depended on Azure/functions-action, and reporting now points to the durabletask repo as a possible re-compromise after the May incident. Microsoft also said a small number of customers were notified after pulling content from the affected repos.
That leaves two exposure points: pipelines that broke the moment the repos disappeared, and builds or artifacts that may have consumed tainted content before the shutdown. For teams using Microsoft-hosted GitHub actions or packages, the problem is no longer just whether the repo is back; it is whether anything already pulled from it still belongs in the supply chain.
3 sources covering this story
Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues
Microsoft confirms it temporarily removed GitHub repos after Miasma worm compromised 73 of its open-source projects to inject an information stealer.
GitHub disables Microsoft repos pushing password-stealing malware
Microsoft removed 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub, disrupting continuous integration pipelines.
Microsoft's open source tools were hacked to steal passwords of AI developers | TechCrunch
Microsoft shut down dozens of GitHub code repositories for Azure and AI coding tools after a reported hack.
Part of the PlainSec briefing for 2026-06-10