# Miasma / Shai-Hulud Supply-Chain Campaign Pushes Password-Stealing Malware via Compromised Microsoft GitHub Repos (durabletask PyPI 1.4.1-1.4.3)

> On June 5, 2026, GitHub disabled 73 repositories across Microsoft's Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations after they were abused to push password-stealing malware as part of the self-replicating Miasma/Shai-Hulud npm/PyPI supply-chain worm. Attackers compromised a Red Hat employee's GitHub account, pivoted to Microsoft resources, injected a minimal workflow that requested GitHub OIDC tokens, and targeted developer credentials and AI coding tools (Claude Code, Gemini CLI, VS Code, Cursor). GitHub contained the incident in 105 seconds and Microsoft restored all repositories as clean.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0733
- **ID:** TL-2026-0733
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Shai-Hulud worm operators
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The June 5, 2026 disablement of 73 Microsoft-owned GitHub repositories is the latest wave of the Shai-Hulud self-replicating supply-chain worm (also tracked under the 'Miasma' and 'IronWorm'/'Mini Shai-Hulud' labels), a campaign that has repeatedly backdoored the npm and PyPI ecosystems since September 2025. In this wave, threat actors compromised a Red Hat employee's GitHub account and used it to pivot into Microsoft's Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations. They injected a minimal malicious GitHub Actions workflow that requested GitHub's OIDC tokens, enabling token theft and onward access. The compromise of the 'durabletask' project in May 2026 produced three malicious PyPI releases (1.4.1, 1.4.2, 1.4.3), and the 'Azure/functions-action' GitHub Action was disabled during remediation, causing deployment-workflow outages for downstream consumers.

The broader Shai-Hulud worm operates by injecting a 'preinstall' script into compromised package.json files together with two payload files, setup_bun.js (a loader that installs the Bun runtime from bun.sh/install) and bun_environment.js (a >10 MB heavily obfuscated credential stealer). Execution during the pre-install phase (rather than post-install) removes the need for human interaction and widens impact across developer workstations and CI/CD pipelines. Using the embedded TruffleHog binary and bespoke enumeration, the malware harvests credentials from the local filesystem and from cloud environments — AWS (IMDSv2, ECS metadata, SSO tokens, credential files), Google Cloud, Azure, Kubernetes, HashiCorp Vault, SSH keys, npm tokens (.npmrc), GitHub Personal Access Tokens, and crypto wallets — writing them to staging files named cloud.json, contents.json, environment.json, and truffleSecrets.json.

Stolen secrets are exfiltrated by creating public GitHub repositories (repo names matching the pattern [0-9a-z]{18}) carrying fixed descriptions such as 'Sha1-Hulud: The Second Coming' and 'Sha1-Hulud: The Continued Coming'. The worm self-propagates: using a stolen npm token it authenticates as the victim developer, enumerates that developer's other packages, injects the payload, and republishes them, spreading exponentially without operator intervention. For persistence and remote execution it registers compromised hosts as self-hosted GitHub Actions runners named SHA1HULUD and commits a malicious workflow (.github/workflows/discussion.yaml). Some variants impersonate 'Linus Torvalds' as the commit author. If credential theft fails, certain variants attempt to destroy the victim's home directory via secure overwriting, marking a shift from espionage toward sabotage. The November 24, 2025 (Shai-Hulud 2.0) wave alone backdoored roughly 700-796 unique npm packages (>20M weekly downloads) and created 25,000+ malicious repositories across ~500 GitHub users, while the May 2026 'Mini Shai-Hulud' resurgence affected 170+ npm packages and 2 PyPI packages. Microsoft Defender detects components as Trojan:JS/ShaiWorm and Behavior:Win32/SuspBunActivity.A.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1586 Compromise Accounts
- T1608 Stage Capabilities
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1684.001 Impersonation
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1526 Cloud Service Discovery
- T1005 Data from Local System
- T1080 Taint Shared Content
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1485 Data Destruction

## Sources

- [GitHub disables Microsoft repos pushing password-stealing malware](https://www.bleepingcomputer.com/news/security/github-disables-microsoft-repos-pushing-password-stealing-malware/)
- ["Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain Attack](https://unit42.paloaltonetworks.com/npm-supply-chain-attack/)
- [Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/)
- [The Shai-Hulud 2.0 npm worm: analysis, and what you need to know](https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/)
- [Shai-Hulud 2.0: Ongoing Supply Chain Attack — 25K+ Repos Exposed](https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack)
- [Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems](https://www.trendmicro.com/en_us/research/25/k/shai-hulud-2-0-targets-cloud-and-developer-systems.html)
- [Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading](https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed)
- [Shai-Hulud npm supply chain attack — new compromised packages detected](https://jfrog.com/blog/shai-hulud-npm-supply-chain-attack-new-compromised-packages-detected/)
- [Shai-Hulud npm supply chain attack: What you need to know](https://www.reversinglabs.com/blog/shai-hulud-worm-npm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0733