A repo takedown is only half a cleanup when downstream builds already trusted what was there. Here, the immediate damage was CI breakage, but the deeper risk is that Microsoft-owned repo history may still carry residue from the earlier compromise, so restoring access does not automatically restore trust.
Microsoft disabled 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations after the Miasma/Shai-Hulud supply-chain campaign, then restored some of them while the investigation continued. The disruption hit workflows that depended on Azure/functions-action, and reporting now points to the durabletask repo as a possible re-compromise after the May incident. Microsoft also said a small number of customers were notified after pulling content from the affected repos.
That leaves two exposure points: pipelines that broke the moment the repos disappeared, and builds or artifacts that may have consumed tainted content before the shutdown. For teams using Microsoft-hosted GitHub actions or packages, the problem is no longer just whether the repo is back; it is whether anything already pulled from it still belongs in the supply chain.