GitHub nukes 70+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections

Microsoft’s GitHub temporarily disabled over 70 repositories after they were reportedly compromised by a worm in the latest open source supply chain attack. The code shack took down 73 repos within the space of 105 seconds after its alarms were tripped on Friday, June 5, after detecting signs of the Miasma worm infecting its …

[Dan 55]

Captain, there's a Codeberg right ahead!

Can someone do a Titanic meme about GitHub?

[Alien Doctor 1.1]

Re: Captain, there's a Codeberg right ahead!

It's like rearranging the repositories on the the Titanic.

[ecofeco]

Re: Captain, there's a Codeberg right ahead!

And the band played on.

[Locomotion69]

Re: Captain, there's a Codeberg right ahead!

AI never let go Jack, AI never let go.....

[Anonymous Coward]

Re: Captain, there's a Codeberg right ahead!

I think GitHub just needs shut down for the benefit of all mankind. It seems to have become the Sunday Sport of repositories- full of slime, compromise and coercive behaviour (via nefarious code injection).

[Yet Another Anonymous coward]

Re: Captain, there's a Codeberg right ahead!

"never find a more wretched hive of scum and villainy"

[Soruk]

Re: Captain, there's a Codeberg right ahead!

It's syncing, Jack.

[Softsuits]

Re: Captain, there's a Codeberg right ahead!

Wow! What great fireworks over on the Azure container ship. I guess they don't really need our help.

[SCP]

Re: Captain, there's a Codeberg right ahead!

This seems like a plight to remember.

[Dinanziame]

Ugh

To the risk of sounding like a fragile little flower, I'd rather not see a surprise close-up of wriggling worms when opening the register. But I am indeed a fragile little flower. Sorry about this, feel free to downvote, I'm already a bit embarrassed I'm posting this.

[Tom Chiverton 1]

Re: Ugh

No need ! I've had a uBlock Origin rule that hides the stupidly last first image in an article for years, just to save wear and tear on the scroll wheel :)

[MiguelC]

Re: Ugh

is it ||image.theregister.com/*.jpg$image ?

[jvf]

Re: Ugh

To a farmer, it's a beautiful sight.

[Jou (Mxyzptlk)]

Re: Ugh

https://www.theregister.com/Week/ is "worm free". They simply forgot that, previously, the first four articles showed a picture. Now none of them show a picture, and I miss nothing (I had to check of course, yeah, not during lunch or dinner...).

[logicalextreme]

Re: Ugh

Zomg thank you for this. Didn't realise there was a usable homepage. The redesign is hell

[Elongated Muskrat]

Re: Ugh

Agreed, there hasn't been a redesign this bad since Windows 8.

[This is my handle]

Re: Ugh

As a young man (still living with Mom & Dad in fact) I came home after my 2nd shift job. Mom had left some spaghetti on the stove. My cousin was visiting, with an appetite, and had been told I got first crack at the leftovers. I didn't know this, but scooped the entirety of what the family hadn't eaten on to my plate after heating it up. "That looks good!", my cousin said. "But doesn't spaghetti remind you of bleached worms!?" He got the leftovers, I made a snack of fruit & yoghurt or something. Decades later, as an inveterate composter, I look rather fondly upon vermiculture: which does, not coincidentally share a Latin root with vermicelli, LOL.

[heyrick]

Re: Ugh

I clicked the article because "ooh, spaghetti!". Now I go back and discover it was worms. I guess it's time for lunch...

(icon, because duh)

[ThatOne]

Hunting AI developers

Did I misunderstand something, or do all those attacks mentioned target AI developers?

Does that mean that normal people can rest easy?

[Jou (Mxyzptlk)]

Re: Hunting AI developers

To me it reads that ONE developer with access to those was enough to start the wave. Possibly others followed and made it stronger when they started to work. Whether all use AI or some still use their brain is, well, given the state of MS code quality, a rhetorical question...

[QET]

Re: Hunting AI developers

That's the gist I'm getting too.

"AI" "assistants" built-in into software development programs helpfully assisted by making the worm propagate.

AKA fully automated "move fast and break things".

The future is grand if you're a scumbag or a sucker.

[MonkeyJuice]

Re: Hunting AI developers

In this case, yes. On the other hand, the rate of supply chain attacks hitting core dependencies on npm and pypi is getting alarming. It surely is a matter of time before something very, very bad happens. Pin your dependencies, do not over-eagerly update them unless they are security fixes, and generally stay stressed and suspicious...

[sarusa]

Ahahaha

Microslop gonna slop. And sloperators gonna get slopped. This is great.

[ecofeco]

Re: Ahahaha

Smooth sloperators.

[elsergiovolador]

Reassuring

It's very reassuring that many government services run on Microslop.

[razorfishsl]

Why is it that everything MSlop touches turns to shit.

[Blackjack]

And this is mostly a problem thanks to AI crap having almost no code execution safeguards.

[frankvw]

I don't get it

If MICROS~1 is so hell-bent on destroying Github (which they clearly are) why don't they just close it down and get it over with? Since they acquired Github it's been dying slowly. Why do they prolong the agony so much?

Because the end is inevitable. Github is simply one of the last entries in the long list of products and businesses that MICROS~1 acquired and then flushed down the toilet. Nothing of what we're seeing here surprises me at all.

I just wish they'd admit it by simply killing their acquisitions right away rather than let them perish slowly.