The ones I know of aren’t offensive tooling or exploits - they are all related to azure functions…
I wondered if is related to the durabletask stuff being compromised as part of the GitHub breach the other week.
DurableTask is largely used by azure functions.
3 versions of it were pushed with malware in.
So I wondered if this is an incident response action.
Scanning the Azure org using gh CLI for disabled repos.
The timestamps are unnaturally clustered
Every single repo shows:
updated_at ≈ 2026-06-05 16:00 UTC
pushed_at ≈ 2026-06-05 02:00-07:00 UTC
That’s not organic project activity.
That looks like a bulk operation touching all repos in the set at roughly the same time.
This is clearly not just DurableTask
The blast radius includes:
Core Functions runtimeAll language workersAll durable extensionsCore ToolsWebJobs SDKDocker imagesGitHub ActionsExtension bundlesOpenAI extensionMCP extensionConnector SDKsAgent runtime
This is basically:
“everything related to Azure Functions as a platform”
The stars matter
Some of these are not obscure repos:
Repo Stars
azure-functions-host 2010
durabletask 1718
azure-functions-core-tools 1450
azure-webjobs-sdk 752
durable-extension 764
You don’t casually disable the flagship repos of a major cloud service.
The newer additions are fascinating
These jumped out:
azure-functions-openai-extension
azure-functions-mcp-extension
azure-functions-agents-runtime
Those are AI-era additions.
Which suggests the disablement logic wasn’t:
“disable the historically compromised repo”
It looks more like:
“disable the entire Functions ecosystem”
The Connectors repos are weird
These:
Connectors-NET-SDK
Connectors-NET-LSP
Connectors-NodeJS-SDK
connectors-python-sdk
have:
stars = 0
and are still disabled.
That argues against popularity, malware reports, forks, or stars being the trigger.
They’re simply part of the same family.
