--- title: Microsoft repos nuked by Miasma worm, Spring security... description: A multi-story security and AI developer news roundup covering: GitHub nuked 73 Microsoft repos after the Miasma worm injected credential-stealing malware into... canonical: https://daily.dev/posts/microsoft-repos-nuked-by-miasma-worm-spring-security-advisories-surge-1-700--ad5awisdz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft repos nuked by Miasma worm, Spring security advisories surge 1,700% | daily.dev og:description: A multi-story security and AI developer news roundup covering: GitHub nuked 73 Microsoft repos after the Miasma worm injected credential-stealing malware into... og:url: https://daily.dev/posts/microsoft-repos-nuked-by-miasma-worm-spring-security-advisories-surge-1-700--ad5awisdz og:image: https://api.daily.dev/og/posts/aD5AWISDz.png og:image:alt: Microsoft repos nuked by Miasma worm, Spring security advisories surge 1,700% og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft repos nuked by Miasma worm, Spring security advisories surge 1,700% **[Backend Digest](https://daily.dev/sources/backend_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary A multi-story security and AI developer news roundup covering: GitHub nuked 73 Microsoft repos after the Miasma worm injected credential-stealing malware into packages that activate inside AI coding agents; Broadcom released the largest Spring security update in 20 years as AI-driven vulnerability discovery caused a 1,700% surge in monthly advisories; Vercel's AI Gateway data shows DeepSeek jumped to 17% token share while Anthropic holds 65% of spend, confirming a two-tier routing pattern; protobuf.js disclosed six CVEs including an RCE via JavaScript's Function() constructor affecting 50M+ weekly downloads. Also notable: Cisco SD-WAN Manager under active exploitation, Terraform 1.15 ships dynamic module sources, Qwen 3.7 Max hits Code Arena #4, Apache Cassandra 6.0 adds ACID transactions, and Amazon OpenSearch Serverless NextGen launches. ## Content **TLDR:** GitHub removed 73 Microsoft-owned repositories after a supply chain attack injected credential-stealing malware into packages that activate when opened in AI coding agents. This is the second such attack in weeks, following a May hit on Microsoft's durabletask Python SDK. Separately, Broadcom is shipping what it calls the largest Spring security update in the framework's 20-year history, driven by AI tools that are dramatically shortening the window between vulnerability discovery and exploit. On the data side, Vercel's production index shows DeepSeek's token share jumped from under 1% to 17% in May while Anthropic's spend share grew to 65%, confirming a two-tier routing pattern where cheap models handle volume and frontier models handle quality-critical work. --- ## Miasma worm hits 73 Microsoft repos, breaks CI/CD pipelines globally The attacker group TeamPCP exploited stolen Microsoft publishing credentials to inject the Miasma credential stealer into 73 cryptographically verified packages. The malware targets AWS, Azure, GCP, Kubernetes, password managers, and 90+ developer tool configs, then spreads laterally through cloud infrastructure. The attack vector is particularly sharp: Miasma triggers when developers open affected packages in AI coding agents, not just on install. GitHub initially described the takedown as a terms-of-service violation rather than disclosing the malicious nature of the packages, which drew criticism. This follows a May attack on Microsoft's durabletask Python SDK on PyPI using the same attacker. [Read more](https://app.daily.dev/feed-by-ids?id=FRfTqlS6g&id=7xWiEYHC9&id=H3H6uJb7S) ## Broadcom ships largest-ever Spring security update as AI-driven vulnerability discovery surges Monthly security advisories reported to Broadcom increased over 1,700% from March to April 2026, driven by researchers using frontier AI models to find and exploit vulnerabilities faster than traditional patch cycles allow. The release covers SLSA Level 3-validated clean room builds across over 100,000 validated dependency builds in the Spring Boot bill of materials. Enterprise Tanzu Spring customers get zero-day CVE-only patch releases before open source publication — a monetization move that analysts are criticizing given Spring's critical role in the ecosystem. Roughly 60% of Spring runtimes being downloaded are already out-of-support versions, which makes the exposure window worse. [Read more](https://app.daily.dev/feed-by-ids?id=uechdZnsP&id=RDqWNJ8Ef&id=ML17nHiky) ## DeepSeek hits 17% token share on Vercel's gateway while Anthropic holds 65% of spend Vercel's June 2026 AI Gateway production index covering May shows DeepSeek's token share surging from under 1% to 17% after the launch of DeepSeek V4 Flash and V4 Pro, priced 20-50x cheaper than comparable Anthropic models — yet its spend share stayed near 1%. Anthropic grew spend share from 61% to 65%, dominating 70-80% of spend in coding agents and back-office automation. Overall token volume grew 20% month-over-month while spend grew 43%, confirming teams are routing cheap high-volume tasks to low-cost models and reserving frontier models for quality-critical work. Gemini 3.5 Flash saw slow adoption compared to 3.0 Flash, illustrating cost-driven upgrade hesitancy even when a newer model is available. [Read more](https://app.daily.dev/posts/CaIs1dY8H) ## protobuf.js CVEs enable RCE in Node.js via schema-derived code execution Cyera researchers disclosed six CVEs in protobuf.js, which has over 50 million weekly downloads. The most critical flaw, CVE-2026-44291, lets attackers manipulate schema-derived data so it becomes executable code via JavaScript's Function() constructor, enabling remote code execution inside Node.js processes. A separate CLI vulnerability, CVE-2026-44295, allows crafted schema names to inject code into generated JavaScript files. Because protobuf.js is frequently pulled in as a transitive dependency through gRPC tooling and Google Cloud libraries, many teams are exposed without knowing it. Patches are available in protobuf.js 7.5.6 and 8.0.2, and protobuf.js-cli 1.2.1 or 2.0.2. [Read more](https://app.daily.dev/posts/sSMnsKxPA) --- ## Also notable - **Cisco SD-WAN Manager under active exploitation, no patch yet for CVE-2026-20245:** Cisco disclosed an actively exploited high-severity CLI vulnerability in Catalyst SD-WAN Manager that lets authenticated netadmin users escalate to root via crafted file upload and command injection; reported by Google Mandiant and potentially linked to cyberespionage group UAT-8616, with indicators of compromise visible in scripts.log and no patch currently available. [Read more](https://app.daily.dev/posts/flFTxGM0p) - **Terraform 1.15 ships dynamic module sources and variable deprecation, closing gap to OpenTofu:** Terraform 1.15 adds dynamic module sources via a new `const` variable attribute and a formal `deprecated` attribute for variables and outputs — features OpenTofu has had since versions 1.8 and 1.10 respectively, making the continued divergence between the two projects concrete and measurable. [Read more](https://app.daily.dev/posts/eC0J87Ui7) - **Qwen 3.7 Max hits Code Arena #4 at roughly a third of Claude Opus 4.7's price:** Qwen 3.7 Max debuted at Elo 1541 on the Code Arena WebDev leaderboard, one point behind Claude Opus 4.6 Thinking, priced at $2.50/$7.50 per million input/output tokens versus Claude Opus 4.7's $5/$25 — with a 90% cached-input discount making it a practical drop-in for long-context Claude Code sessions via a base URL change. [Read more](https://app.daily.dev/feed-by-ids?id=zz9M4YZDv&id=4GdDsQk0R) - **Apache Cassandra 6.0 alpha adds ACID transactions via Accord consensus protocol:** Cassandra 6.0 introduces Accord, a leaderless consensus protocol delivering strict serializable isolation across multiple partitions, alongside Transactional Cluster Metadata replacing Gossip Protocol and built-in repair scheduling — shifting significant operational work back into the database from application teams and external tooling. [Read more](https://app.daily.dev/posts/GbkadaqjJ) - **Amazon OpenSearch Serverless NextGen delivers 20x faster provisioning and true scale-to-zero at 60% lower cost:** The redesigned NextGen architecture decouples stateless compute OCUs from storage, enabling true scale-to-zero and up to 60% cost reduction versus provisioned clusters, now generally available with a per-account regional endpoint and deeper integration with Cursor, Claude Code, and Codex via OpenSearch Agent Skills. [Read more](https://app.daily.dev/posts/wVhmg6i9v) ## Similar posts on daily.dev - [GitHub disables Microsoft repos pushing password-stealing malware](https://daily.dev/posts/github-disables-microsoft-repos-pushing-password-stealing-malware-oglknbpvl) · BleepingComputer · 1 upvotes · 0 comments - [GitHub nukes 70\+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections](https://daily.dev/posts/github-nukes-70-microsoft-repos-breaks-ci-cd-pipelines-following-suspected-worm-infections-7xwieyhc9) · The Register · 74 upvotes · 13 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#spring](https://daily.dev/tags/spring) [View this post on daily.dev](https://daily.dev/posts/microsoft-repos-nuked-by-miasma-worm-spring-security-advisories-surge-1-700--ad5awisdz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/microsoft-repos-nuked-by-miasma-worm-spring-security-advisories-surge-1-700--ad5awisdz","headline":"Microsoft repos nuked by Miasma worm, Spring security advisories surge 1,700%","text":"A multi-story security and AI developer news roundup covering: GitHub nuked 73 Microsoft repos after the Miasma worm injected credential-stealing malware into packages that activate inside AI coding agents; Broadcom released the largest Spring security update in 20 years as AI-driven vulnerability discovery caused a 1,700% surge in monthly advisories; Vercel's AI Gateway data shows DeepSeek jumped to 17% token share while Anthropic holds 65% of spend, confirming a two-tier routing pattern; protobuf.js disclosed six CVEs including an RCE via JavaScript's Function() constructor affecting 50M+ weekly downloads. Also notable: Cisco SD-WAN Manager under active exploitation, Terraform 1.15 ships dynamic module sources, Qwen 3.7 Max hits Code Arena #4, Apache Cassandra 6.0 adds ACID transactions, and Amazon OpenSearch Serverless NextGen launches.","url":"https://daily.dev/posts/microsoft-repos-nuked-by-miasma-worm-spring-security-advisories-surge-1-700--ad5awisdz","datePublished":"2026-06-09T04:18:44.135Z","dateModified":"2026-06-09T04:19:08.481Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"Microsoft repos nuked by Miasma worm, Spring security advisories surge 1,700%"}]} ```