A self-replicating supply chain attack known as the “Miasma worm” has compromised 73 Microsoft GitHub repositories across four organizations — Azure, Azure-Samples, Microsoft, and MicrosoftDocs — prompting GitHub to disable access to the affected repositories. The attack represents a significant escalation in software supply chain threats, weaponizing AI coding agents as the infection vector.
The attack began with a malicious commit pushed to the Azure/durabletask repository using a previously compromised contributor account. The Miasma worm deployed configuration files that automatically execute a credential-harvesting payload when developers open infected repositories in AI coding tools including Claude Code, Gemini CLI, Cursor, or VS Code. Miasma is an evolved variant of the Mini Shai-Hulud worm publicly released by TeamPCP in mid-May 2026. The campaign has continued to mutate, skipping the npm registry entirely in some cases to push malicious code directly to popular repositories like icflorescu/mantine-datatable.
Security researcher Paul McCarty noted the link to last month’s compromise of the durabletask PyPI package, suggesting the attackers never fully lost the credentials from the original breach: “When the repo at the root of last month’s compromise is the hub of this month’s takedown, that is not a coincidence — that is the same wound reopening.”
Source
The Hacker News · StepSecurity · Redmond Magazine
Commentary
This is the attack that the security community has been warning about since AI coding agents went mainstream. The Miasma worm doesn’t exploit a traditional software vulnerability — it exploits the trust model of AI development tools. When a developer opens a repository in Claude Code, Cursor, or VS Code, these tools automatically read and execute configuration files. The attackers planted payloads that trigger on repository open, turning the developer’s most trusted tools into the attack vector.
The implications are staggering. Microsoft’s own repositories — including core Azure infrastructure — were compromised. The fact that GitHub had to disable 73 repos means downstream projects that depend on these packages are broken right now. Any organization pulling from Azure SDK repositories needs to audit their dependency chain immediately. This is supply chain security’s worst nightmare: a self-replicating worm that spreads through the very tools developers use to write and review code.