Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories
A sophisticated supply chain attack, orchestrated by the Miasma worm (a variant of Shai-Hulud), targeted 73 Microsoft GitHub repositories, primarily within the Azure organization. The attack, initially discovered through Open Source Malware, disrupted CI/CD workflows and highlighted vulnerabilities in Microsoft's software supply chain. The incident involved the poisoning of Microsoft's durabletask Python SDK and the exploitation of a compromised contributor account, raising concerns about credential theft and potential deployment of destructive malware.
The recent attack, first reported by Open Source Malware on June 5th, involved a worm – a variant of Shai-Hulud – that systematically compromised 73 Microsoft GitHub repositories, predominantly within the Azure organization. The attack leveraged the GitHub Actions CI/CD pipeline, causing widespread disruptions for organizations relying on the affected GitHub Actions, most notably Azure/functions-action. This disruption highlights the significant risk posed by vulnerabilities within widely used open-source components, particularly those integrated into critical development workflows. The attack underscores the need for robust vulnerability management and supply chain security practices within organizations.
The root of the problem lies in a previously compromised GitHub account, which was also targeted in a prior Miasma attack against Red Hat npm packages. StepSecurity’s research revealed that three poisoned versions of Microsoft’s durabletask Python SDK were published to PyPI, downloaded approximately 400,000 times before Microsoft’s intervention. This package contained a modular cloud intrusion framework, ‘rope.pyz,’ designed to steal secrets and credentials and deploy a wiper. The attack was linked to TeamPCP, a group known for its supply chain attacks, and involved the exploitation of a compromised contributor account, suggesting a failure in Microsoft’s credential rotation and security protocols. Microsoft has since restored the affected repositories after a thorough review.