Summary
The Miasma supply chain worm — an evolved variant of the Mini Shai-Hulud worm family — has dramatically expanded its reach beyond the initial Red Hat NPM compromise. On June 5, 2026, the worm compromised 73 Microsoft GitHub repositories across four organizations (Azure, Azure-Samples, Microsoft, and MicrosoftDocs) by pushing malicious commits containing credential-harvesting payloads that trigger the moment a developer opens the repository in AI coding tools like Claude Code, Gemini CLI, Cursor, or VS Code.
In parallel, the “Hades Campaign” wave hit PyPI between June 7-8, poisoning at least 19-26 packages across 37 malicious wheel files. The attack primarily targeted bioinformatics and machine learning packages. Unlike the NPM variant, the Hades payload uses Python .pth startup hooks to execute a Bun-powered JavaScript credential stealer every time the Python interpreter starts — no explicit import required. Notable affected packages include dynamo-release, spateo-release, and coolbox.
On June 10, the full Miasma attack framework toolkit was publicly leaked via a compromised developer account on GitHub, lowering the barrier for copycat attacks. The worm harvests GitHub tokens, AWS/Azure/GCP credentials, SSH keys, Kubernetes secrets, and AI tool configurations. Exfiltrated data is stashed in newly created GitHub repos used as “dead drops.” In response, GitHub has announced that npm v12 (expected July 2026) will disable install scripts by default.
Sources
- The Hacker News — Miasma Worm Hits 73 Microsoft GitHub Repos
- The Hacker News — Hades PyPI Attack: 19 Packages Poisoned
- Phoenix Security — Miasma Azure & Hades PyPI Supply Chain Worm 2026
- SafeDep — Inside the Miasma Supply Chain Attack Toolkit
Commentary
Miasma represents the most aggressive supply chain worm campaign we’ve seen. What makes it especially dangerous is the multi-vector approach: NPM, PyPI, GitHub repos, and AI coding tool configurations are all attack surfaces in a single coordinated campaign. The weaponization of AI coding tools as an infection vector is a genuinely novel tradecraft development — attackers are targeting the exact tools developers trust to help them write code.
The public leak of the Miasma toolkit on June 10 is a force multiplier. Expect copycat campaigns using the same techniques across every public package registry. If your organization uses open-source dependencies (everyone), this is a wake-up call to audit your supply chain security: pin versions, verify provenance, disable install scripts, and treat every npm install or pip install as potentially hostile. GitHub’s upcoming npm v12 changes are a welcome step, but the fundamental trust model of package registries remains broken.