software supply chain

About this tag
The software supply chain tag on WindowsForum covers threats and vulnerabilities that target the development pipeline rather than end-user systems. Recent discussions focus on the Miasma worm, which compromised Microsoft GitHub repositories through stolen contributor credentials and planted payloads that activated when developers opened repos in AI-assisted coding tools. Other topics include CVE-2026-34182, an OpenSSL vulnerability affecting Windows shops, and CVE-2026-45644, an elevation-of-privilege issue in the Live Share Canvas SDK. CISA warnings about poisoned VS Code extensions and malicious GitHub Actions workflows are also covered. The common thread is that modern software supply chain attacks exploit trust in source control, CI/CD pipelines, editor plugins, and AI agents, shifting the security boundary to the developer workstation.
  1. Miasma Malware: Microsoft GitHub Repos Disabled After AI Coding Credential Theft

    On June 5, 2026, GitHub disabled 73 Microsoft-owned repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs after researchers found Miasma malware planted in projects that could steal developer credentials when opened in AI-assisted coding tools and modern IDEs. The breach was not...
  2. CVE-2026-34182: OpenSSL CMS AuthEnvelopedData Forgeries and Windows Patch Triage

    CVE-2026-34182 is an OpenSSL vulnerability published on June 9, 2026, in which CMS AuthEnvelopedData handling may accept forged messages because OpenSSL does not sufficiently validate cipher choices and authentication tag lengths. The MSRC link circulating with the CVE currently resolves to a...
  3. Miasma Worm: How GitHub Disabled Microsoft Repos and Broke CI/CD

    On June 5, 2026, GitHub disabled 73 Microsoft-owned repositories across Azure, Azure-Samples, microsoft, and MicrosoftDocs after researchers said the Miasma supply-chain worm used a compromised contributor path to plant malicious developer-tool configuration files in Microsoft’s open-source...
  4. Miasma Worm Turns Repo Opening Into Credential Theft for AI Coding Agents

    GitHub disabled 73 Microsoft-owned repositories on June 5, 2026, after the Miasma worm reportedly reached Azure’s durabletask project through a compromised contributor account and planted credential-stealing payloads designed to run inside developer tools and AI coding agents. The incident...
  5. CVE-2026-45644: Live Share Canvas EoP Shows Why SDK Security Needs Patch Discipline

    Microsoft has listed CVE-2026-45644 as an elevation-of-privilege vulnerability in the Microsoft Live Share Canvas SDK in its June 2026 Security Update Guide, making this a developer-supply-chain security issue rather than a conventional Windows desktop patch emergency. The important word is not...
  6. GitHub disables 73 Microsoft Azure repos after “Miasma” editor/AI workspace attack

    On June 5, 2026, GitHub disabled 73 repositories across Microsoft’s Azure, Microsoft, Azure-Samples, and MicrosoftDocs organizations after a malicious commit was pushed to Azure/durabletask through a reportedly compromised contributor account. The immediate blast radius was not Windows Update or...
  7. Miasma Worm: How AI Coding Agents Turn “Open a Repo” Into a Security Boundary

    On June 5, 2026, GitHub disabled 73 Microsoft-related repositories across Azure, Microsoft, and Azure Samples organizations after the Miasma worm campaign allegedly used a compromised contributor account to plant credential-stealing payloads aimed at AI coding tools. The incident is not merely...
  8. CISA Warns: Poisoned VS Code Extensions and Megalodon Workflows Hit Build Systems

    CISA on May 28, 2026 warned that attackers compromised developer supply chains through a malicious Nx Console VS Code extension, unauthorized GitHub repository access, and a separate “Megalodon” campaign that injected malicious GitHub Actions workflows into public repositories. The alert is not...
  9. CISA KEV May 27, 2026: Supply-Chain Attacks via DAEMON Tools, TanStack, Nx Console

    CISA added CVE-2026-8398, CVE-2026-45321, and CVE-2026-48027 to its Known Exploited Vulnerabilities Catalog on May 27, 2026, after confirming active exploitation affecting DAEMON Tools Lite, TanStack packages, and the Nx Console developer extension. The move is more than another federal patching...
  10. Notepad++ for Mac Controversy: Fork Trust, Branding, and User Safety

    Notepad++ creator Don Ho publicly denounced an unauthorized macOS port in early May 2026 after developer Andrey Letov launched it as “Notepad++ for Mac,” using the project’s name, chameleon branding, Ho’s identity, and a similarly named website despite lacking official approval. The fight is not...
  11. Notepad++ macOS Port Trademark Row: Forking Code vs Borrowing Identity

    On May 4, 2026, Notepad++ creator Don Ho publicly denounced a macOS port of the Windows text editor as unauthorized, saying it used the Notepad++ name, logo, and presentation in ways that misled users and media into believing it was official. The dispute is not really about whether open-source...
  12. CVE-2026-33055: tar-rs PAX Size Parsing Bug and Why It’s a Supply-Chain Risk

    CVE-2026-33055 is a reminder that archive parsing bugs rarely stay “just” theoretical. Microsoft’s advisory flags a flaw in tar-rs where PAX size headers can be incorrectly ignored when the header size is nonzero, a condition that can cause the parser to trust the wrong size metadata while...
  13. CISA Adds TrueConf KEV CVE-2026-3502: Patch Code Integrity Flaws Now

    CISA’s latest Known Exploited Vulnerabilities Catalog update is a reminder that the agency’s most important work is less about counting bugs than about narrowing the attack surface that adversaries actually use. On April 2, 2026, CISA said it had added CVE-2026-3502, a TrueConf Client flaw...
  14. Malicious npm Axios releases (Sapphire Sleet) show cross-platform supply chain risk

    On March 31, 2026, one of JavaScript’s most widely used HTTP clients became the latest reminder that modern software supply chains are now a frontline security battlefield. Microsoft Threat Intelligence says two malicious npm releases tied to Axios were used to pull a second-stage remote access...
  15. CISA Adds Trivy CVE-2026-33634 to KEV: Patch Supply Chain Risk Now

    CISA’s latest addition to the Known Exploited Vulnerabilities (KEV) Catalog is a sharp reminder that software supply chain risk is no longer an abstract concern for security teams. On March 26, 2026, the agency added CVE-2026-33634, described as an Aqua Security Trivy embedded malicious code...
  16. UniGetUI 2026.1.3: Devolutions Stewardship, Stable Releases, Trustworthy Windows Package UI

    UniGetUI’s latest 2026.1.3 coverage lands at an interesting moment for the Windows package-management ecosystem: the project has moved under Devolutions’ stewardship, its GitHub repository now emphasizes both consumer usability and enterprise readiness, and the most recent public release train...
  17. UniGetUI 2026.1.x: Devolutions Acquisition Tightens Distribution and Security

    UniGetUI’s newest release and the stewardship shift announced in March 2026 mark a decisive moment for a tool millions of Windows users rely on to discover, install, and update software without touching the command line. What began as a one‑developer project has just entered an organizational...
  18. Azure Linux Attestation and Twisted.web CVE-2024-41671: What You Should Do

    Microsoft’s brief advisory — “Azure Linux includes this open‑source library and is therefore potentially affected” — is accurate, but it is a product‑scoped attestation, not a statement that Azure Linux is the only Microsoft product that could include the Twisted.web library or be affected by...
  19. CVE-2024-6603: Azure Linux Attestation Explained and Why Artifact Verification Matters

    An out-of-memory bug in Mozilla-derived code assigned CVE-2024-6603 can cause a failed allocation to be followed by an unconditional free, producing memory corruption; Microsoft’s public advisory names Azure Linux as a product that includes the implicated open‑source component and is therefore...
  20. Azure Linux Attestation Explained for CVE-2024-41010 and Other Microsoft Artifacts

    Microsoft’s brief MSRC note that “Azure Linux includes this open‑source library and is therefore potentially affected by this vulnerability” is accurate — but it is a product‑scoped attestation, not proof that no other Microsoft artifact can contain the same vulnerable code. Background The...