Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues
Microsoft is investigating a recent security incident involving the compromise of 73 open-source GitHub repositories as part of the ongoing "Miasma" supply chain attack. The attackers, utilizing a technique involving information stealers and AI-powered code execution, injected malicious code into projects like "durabletask" and a range of bioinformatics libraries. This incident highlights the risks associated with software supply chain vulnerabilities and the evolving tactics employed by threat actors.
The incident began when Microsoft detected that 73 of its open-source projects hosted on GitHub had been compromised. The attackers, operating under the "Miasma" campaign, injected an information stealer into the code of these projects, primarily targeting Linux systems. The initial compromise involved the "durabletask" Python package, manipulated by the cybercrime group TeamPCP. Further investigation revealed that the Miasma payload could trigger automatic code execution when developers used AI-powered coding tools or IDEs, representing a significant risk to developer workstations and CI/CD environments. The campaign has expanded to include a new wave of PyPI packages, further demonstrating the breadth of the supply chain compromise.
Microsoft has taken steps to contain the damage by temporarily removing affected repositories and notifying potentially impacted customers. The attackers are employing new delivery mechanisms, including Trojanized native .abi3.so extensions and a .pth loader variant, showcasing their adaptability and ongoing experimentation. A key element of the attack involves adversarial prompt injection, designed to bypass AI-powered security scanners. This highlights the increasing sophistication of supply chain attacks and the need for robust security measures throughout the software development lifecycle.