--- title: Miasma worm hits 73 Microsoft repos, Cloudflare acquires... description: A curated roundup of major developer news: the Miasma supply chain worm compromised 73 Microsoft GitHub repos by targeting AI coding agent config files (Claude... canonical: https://daily.dev/posts/miasma-worm-hits-73-microsoft-repos-cloudflare-acquires-voidzero-dm6qdobdt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Miasma worm hits 73 Microsoft repos, Cloudflare acquires VoidZero | daily.dev og:description: A curated roundup of major developer news: the Miasma supply chain worm compromised 73 Microsoft GitHub repos by targeting AI coding agent config files (Claude... og:url: https://daily.dev/posts/miasma-worm-hits-73-microsoft-repos-cloudflare-acquires-voidzero-dm6qdobdt og:image: https://api.daily.dev/og/posts/DM6qDOBDT.png og:image:alt: Miasma worm hits 73 Microsoft repos, Cloudflare acquires VoidZero og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Miasma worm hits 73 Microsoft repos, Cloudflare acquires VoidZero **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary A curated roundup of major developer news: the Miasma supply chain worm compromised 73 Microsoft GitHub repos by targeting AI coding agent config files (Claude Code, Cursor, Gemini CLI) to harvest cloud credentials, spreading autonomously to any writable repo. Cloudflare acquired VoidZero (Vite, Vitest, Rolldown, Oxc), keeping all projects MIT-licensed and committing $1M to the Vite ecosystem. Cloudflare also traced a 50% ClickHouse query latency improvement to replacing an exclusive mutex with a shared lock in the query planner, now upstream in ClickHouse 25.11. Proxmox VE 9.2 adds dynamic VM rebalancing to fix idle-node problems after failover. Notable items include a CBSE portal exposing 2M student records, Bundler 4.0.13 adding gem publication cooldown, TypeORM hitting 1.0, and Stripe demoing an HTTP 402-based machine payments protocol for AI agents. ## Content **TLDR:** The Miasma supply chain worm compromised 73 Microsoft GitHub repositories by targeting AI coding agent config files, harvesting cloud credentials from developers who cloned affected repos. GitHub disabled the repositories in an automated 105-second sweep, breaking CI/CD pipelines worldwide. Cloudflare's acquisition of VoidZero (covered briefly yesterday) has more detail worth unpacking today. Separately, Cloudflare traced a 50% query latency drop in ClickHouse to a single mutex in the query planner, and Proxmox VE 9.2 ships dynamic VM rebalancing that fixes a long-standing HA gap. --- ## Miasma worm exploits AI coding agent trust model to hit 73 Microsoft GitHub repos The TeamPCP threat group pushed malicious config files into Azure/durabletask that trigger automatic execution when a developer opens the repo in Claude Code, Gemini CLI, Cursor, or VS Code. The 4.6 MB obfuscated payload harvests AWS, Azure, GCP, Kubernetes, npm, and GitHub credentials, then autonomously spreads by committing itself to any repo the victim can write to. GitHub disabled 73 repositories — including Azure/functions-action — in a 105-second automated sweep, snapping CI/CD pipelines for developers globally. The attack vector is worth internalizing: it bypasses package install hooks entirely and goes straight for editor-level config files, which most supply chain defenses don't watch. Remediation: rotate all credentials, audit repos for suspicious config files, and pin GitHub Actions to commit SHAs. [Read more](https://app.daily.dev/feed-by-ids?id=EeZFvGg3X&id=kDc5M9aNT) ## Cloudflare acquires VoidZero, puts $1M into Vite ecosystem fund Cloudflare acquired VoidZero — the company Evan You founded around Vite, Vitest, Rolldown, and Oxc — and the entire team joins Cloudflare. All projects stay MIT-licensed. The $1M ecosystem fund is administered by the Vite core team, not Cloudflare, which is a meaningful structural choice. Vite becomes the foundation of Cloudflare's unified `cf` CLI, with `cf dev` becoming a superset of `vite dev`. The honest read: Cloudflare has serious infrastructure but rough developer experience, and VoidZero built tooling developers actually enjoy. This fits a broader pattern of JavaScript tooling consolidation — Anthropic/Bun, GitHub/npm, Vercel/Turborepo — and whether that stabilizes critical infrastructure or concentrates risk is still an open question. The tools work the same way they did last week; whether that holds in three years is the actual bet. [Read more](https://app.daily.dev/posts/ROgTXL5vD) ## Cloudflare patches ClickHouse mutex bottleneck, cuts query latency 50% After migrating to per-tenant partitioning, Cloudflare's billing pipeline started spending 45% of CPU time in a single function — filterPartsByPartition — waiting on an exclusive mutex in MergeTreeData. The fix replaced the exclusive lock with a shared lock and removed the per-query copy of the full parts list. After deploying in March 2026, query durations dropped 50% and performance stopped correlating with part count growth. The patch is upstream in ClickHouse 25.11. If you're running ClickHouse with high partition counts and seeing unexplained query planner slowdowns, this is worth checking. [Read more](https://app.daily.dev/posts/2YVQ0qcqd) ## Proxmox VE 9.2 adds dynamic VM rebalancing to fix post-failover idle node problem When a failed Proxmox node came back online, workloads stayed wherever they landed during failover — leaving recovered nodes idle and stressed nodes overloaded. VE 9.2's dynamic CRS mode recalculates load across all nodes when a host becomes operational and rebalances automatically with configurable thresholds. The release also adds two HA disarm modes (Freeze and Ignore) for safer maintenance windows, BGP/EVPN route maps and WireGuard in the SDN stack, and a CPU profile manager that shows flag compatibility across cluster nodes to prevent migration failures. [Read more](https://app.daily.dev/posts/rmeKESBBB) --- ## Also notable - **CBSE portal exposed 2 million student records via hardcoded JS password and misconfigured S3:** The breach combined four classic flaws: client-side auth enforcement, a hardcoded master password in frontend JavaScript, missing object-level authorization (OWASP API #1 IDOR/BOLA), and a publicly listable S3 bucket — a useful case study for any team doing API security reviews. [Read more](https://app.daily.dev/posts/FbEDd2KZo) - **Bundler 4.0.13 adds gem publication cooldown to slow supply chain attacks:** Bundler 4.0.13 ships a 'Cooldown' feature that delays resolution of freshly published gems, giving maintainers a window to catch malicious publishes before they propagate — directly relevant given the current wave of supply chain attacks hitting package registries. [Read more](https://app.daily.dev/posts/PUCpGCaDB) - **IceStream benchmarks show 4x speedup on Iceberg equality delete conversion using Paimon SSTable index:** Using Apache Paimon as an indexed backing store instead of Cassandra enables binary search over SSTable files on object storage, delivering up to 4x speedup over naive hash joins for 1 million equality deletes against 550 million rows. [Read more](https://app.daily.dev/posts/J9KTGmACM) - **TypeORM hits 1.0 after nearly a decade, signaling renewed maintenance commitment:** TypeORM 1.0 is out after roughly nine years of development — if you've been avoiding it due to maintenance concerns, the 1.0 milestone is the clearest signal yet that the project has stabilized. [Read more](https://app.daily.dev/posts/arCozn4CZ) - **Stripe's HTTP 402-based machine payments protocol lets AI agents pay for API calls without scraping web UIs:** Stripe principal engineer Steve Kaliski demonstrated shared payment tokens with spend limits scoped to specific sellers, an HTTP 402-based payment signaling protocol with blockchain settlement via Tempo, and an agent-to-commerce protocol (ACP) providing structured JSON checkout — together minimizing blast radius from agent errors like wrong merchant or wrong amount. [Read more](https://app.daily.dev/posts/tdyHP8wbm) ## Similar posts on daily.dev - [Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents](https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant) · StepSecurity · 2 upvotes · 1 comments - [Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack](https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x) · The Next Web · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github-actions](https://daily.dev/tags/github-actions), [#vite](https://daily.dev/tags/vite), [#clickhouse](https://daily.dev/tags/clickhouse), [#proxmox](https://daily.dev/tags/proxmox) [View this post on daily.dev](https://daily.dev/posts/miasma-worm-hits-73-microsoft-repos-cloudflare-acquires-voidzero-dm6qdobdt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/miasma-worm-hits-73-microsoft-repos-cloudflare-acquires-voidzero-dm6qdobdt","headline":"Miasma worm hits 73 Microsoft repos, Cloudflare acquires VoidZero","text":"A curated roundup of major developer news: the Miasma supply chain worm compromised 73 Microsoft GitHub repos by targeting AI coding agent config files (Claude Code, Cursor, Gemini CLI) to harvest cloud credentials, spreading autonomously to any writable repo. Cloudflare acquired VoidZero (Vite, Vitest, Rolldown, Oxc), keeping all projects MIT-licensed and committing $1M to the Vite ecosystem. Cloudflare also traced a 50% ClickHouse query latency improvement to replacing an exclusive mutex with a shared lock in the query planner, now upstream in ClickHouse 25.11. Proxmox VE 9.2 adds dynamic VM rebalancing to fix idle-node problems after failover. Notable items include a CBSE portal exposing 2M student records, Bundler 4.0.13 adding gem publication cooldown, TypeORM hitting 1.0, and Stripe demoing an HTTP 402-based machine payments protocol for AI agents.","url":"https://daily.dev/posts/miasma-worm-hits-73-microsoft-repos-cloudflare-acquires-voidzero-dm6qdobdt","datePublished":"2026-06-07T04:17:56.265Z","dateModified":"2026-06-07T04:18:15.570Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Miasma worm hits 73 Microsoft repos, Cloudflare acquires VoidZero"}]} ```