Microsoft has initiated a phased restoration of some GitHub repositories while keeping others offline, as its investigation into a major supply chain attack continues, the company confirmed this week.
The incident, linked to a threat actor tracked as Miasma, compromised 73 of Microsoft's open-source projects. Attackers injected information-stealing malware into the affected codebases, raising serious concerns about the security of widely trusted open-source dependencies.
Details of the Incident
Microsoft acknowledged the takedowns in a statement to The Hacker News, describing the removals as a precautionary measure taken to protect users and the wider ecosystem while assessments and remediation work were underway.
The attack involved deploying information-stealing malware — software designed to harvest credentials, tokens, and other secrets from any system that downloaded or integrated the tampered code. The scale of the breach, covering 73 distinct projects, indicates a targeted and systematic campaign by the Miasma group rather than a random or opportunistic attack.
Microsoft has not yet revealed the full timeline of the compromise, the duration the malicious code was present before discovery, or the total number of potentially exposed users. Security teams are conducting thorough audits of each affected project before they are considered safe for public access.
Navigating the Security-Disruption Trade-Off
The temporary removal of repositories underscores a critical tension for platform operators. Leaving compromised code accessible risks spreading malware further to developers and organisations reliant on those packages. Conversely, pulling repositories offline disrupts development workflows and can break CI/CD pipelines and automated systems that depend on a stable upstream source.
Microsoft's approach — restoring verified projects while keeping others under review — reflects a cautious, methodical strategy. This acknowledges that remediation progress likely varies across the 73 projects and that some require deeper forensic analysis before they can be deemed secure.
Reinforcing Open-Source Supply Chain Vigilance
The Miasma incident highlights the persistent and evolving threat to the software supply chain, particularly within open-source ecosystems. When a major maintainer like Microsoft is compromised at this scale, the downstream impact can be vast and difficult to quantify.
Information stealers embedded in open-source repositories pose a unique danger. Developers who clone or fork affected code, or who pull dependencies from compromised packages, may unwittingly introduce malware into their build environments and production systems. This risk cascades, eroding trust throughout the dependency chain.
For development teams, the event reinforces essential security practices: implementing software composition analysis (SCA) tools, enforcing code-signing and integrity verification, and actively monitoring for anomalous changes in upstream dependencies — even those from established vendors.
Looking Ahead
Microsoft has not provided a definitive timeline for the full restoration and verification of all 73 repositories. As the Miasma probe continues, the developer community awaits further disclosures on the attack vector, the scope of data exposure, and any systemic security changes Microsoft and GitHub may enact.
The incident serves as a stark reminder: the security of the open-source supply chain is only as strong as its most vulnerable commit. Continuous vigilance and proactive security measures are no longer optional for any team relying on external code.
微軟本週證實，公司已開始分階段恢復部分 GitHub 儲存庫，同時將其他儲存庫保持離線，因其對一宗重大供應鏈攻擊的調查仍在持續進行。
這宗與代號為 Miasma 的威脅行為者相關的事件，導致微軟 73 個開源軟件項目受到入侵。攻擊者在受影響的程式碼庫中注入了竊取資訊的惡意軟件，引發了人們對廣受信賴的開源依賴組件安全性的嚴重擔憂。
事件詳情
微軟在給 The Hacker News 的聲明中承認了關閉儲存庫的舉措，並將移除措施描述為一項預防性行動，旨在評估和修復工作進行期間保護用戶及更廣泛的生態系統。
此次攻擊涉及部署竊取資訊的惡意軟件——一種旨在從任何下載或整合了被篡改程式的系統中竊取憑證、token 及其他秘密資訊的軟件。此次入侵規模涵蓋 73 個不同的項目，表明這是 Miasma 組織進行的有針對性、系統性的攻擊活動，而非隨機或機會主義式的攻擊。
微軟尚未公佈入侵的完整時間表、惡意程式碼在被發現前存在了多長時間，以及可能受影響的用戶總數。安全團隊正在對每個受影響的項目進行徹底審計，以確保其在恢復公開訪問前是安全的。
權衡安全與中斷
臨時移除儲存庫凸顯了平台營運商面臨的關鍵矛盾。讓受入侵的程式碼繼續可存取，有將惡意軟件進一步傳播給依賴這些套件的開發者和組織的風險。反過來說，將儲存庫下線則會中斷開發工作流程，並可能破壞依賴穩定上游來源的 CI/CD pipeline 及自動化系統。
微軟的做法——恢復已驗證的項目，同時將其他項目保持審查狀態——反映了一種謹慎、有條不紊的策略。這承認了修復進展在 73 個項目之間可能存在差異，且部分項目需要更深入的取證分析才能被視為安全。
加強開源供應鏈的警惕性
Miasma 事件突顯了軟件供應鏈面臨的持續且不斷演變的威脅，尤其是在開源生態系統中。當像微軟這樣的主要維護者在此規模上遭到入侵時，其下游影響可能巨大且難以量化。
嵌入開源儲存庫的竊取資訊惡意軟件構成了獨特的危險。開發者若複製或 fork 受影響的程式碼，或從受入侵的套件中拉取依賴組件，可能會在不知情的情況下將惡意軟件引入其建構環境和生產系統。這種風險會連鎖反應，侵蝕整個依賴鏈的信任。
對於開發團隊而言，此事件強化了基本的安全實踐：實施軟件組合分析（SCA）工具、強制執行程式碼簽署和完整性驗證，並積極監控上游依賴組件（即使是來自成熟供應商）中的異常變更。
展望未來
微軟尚未就所有 73 個儲存庫的全面恢復和驗證提供確定的時間表。隨著 Miasma 調查的持續進行，開發者社群正等待關於攻擊媒介、數據洩露範圍以及微軟和 GitHub 可能採取的任何系統性安全變更的進一步披露。
此事件是一個深刻的警醒：開源供應鏈的安全性取決於其最脆弱的一次 commit。對於任何依賴外部程式碼的團隊來說，持續的警惕和主動的安全措施已不再是可選項。