How the Miasma Worm Exploited AI Coding Tools to Compromise 73 Microsoft GitHub Repositories

On June 5, 2026, the global open-source ecosystem witnessed a fundamental and alarming shift in how supply chain attacks operate against enterprise targets. In a highly coordinated event spanning just 105 seconds, GitHub's automated abuse detection systems forcibly disabled 73 repositories across four major Microsoft organizations. This unprecedented batch-takedown included critical infrastructure components, most notably the official Azure Functions deployment actions, which temporarily broke continuous integration pipelines for developers worldwide. The rapid sequence of HTTP 403 blocks, executed between 16:00:50 and 16:02:35 UTC, highlighted the severity of a breach that bypassed traditional security perimeters by targeting the very tools developers use to write code.[1][4]

The culprit behind this massive disruption was the Miasma worm, a highly sophisticated, self-replicating malware strain operated by a known threat group dubbed TeamPCP. While previous generations of supply chain attacks relied on developers actively downloading and installing poisoned software packages, Miasma eliminated that interactive requirement entirely. By evolving beyond the standard playbook of malicious dependencies, the worm demonstrated a terrifying new capability: executing its payload the exact moment a developer simply opened a compromised repository on their local machine, transforming passive code review into an active security incident.[1][4]

To understand the significance of Miasma, one must look at how traditional supply chain compromises typically function. Historically, attackers hide malicious code inside the installation scripts of popular package managers like npm, PyPI, or RubyGems. When a developer runs a command to install a library, these hidden scripts execute in the background. Over the years, the cybersecurity industry has adapted to this threat by deploying specialized scanning tools that audit these specific lifecycle hooks—such as preinstall or postinstall scripts—before allowing the installation to proceed, effectively catching most rudimentary attacks.[3][6]

Miasma successfully bypassed these established defenses by shifting the attack vector forward in the development lifecycle. Instead of waiting for a package to be formally installed or for a build process to initiate, the worm was meticulously designed to trigger its payload during the initial environment setup phase. This meant that simply cloning a repository and opening the folder to inspect the code was enough to compromise a workstation. The attack effectively turned the act of reading code into a dangerous operation, catching both developers and automated security sandboxes completely off guard.[1][2]

The mechanism enabling this instant, zero-click execution was the very tooling designed to make modern developers faster and more efficient: AI coding assistants. The attack specifically targeted the automated configuration parsing routines of popular AI-integrated development environments (IDEs) and command-line interfaces, including Cursor, Claude Code, Gemini CLI, and Visual Studio Code. Because these tools automatically scan workspace files to build context for their large language models, they inadvertently acted as the execution engine for the attackers' hidden scripts, highlighting a severe blind spot in how AI tools handle untrusted code.[1][3]

The breach of Microsoft's infrastructure began when attackers utilized a previously compromised, highly trusted contributor account to push a malicious commit directly to the Azure/durabletask repository. To evade casual human review and automated anomaly detection, the attackers employed sophisticated metadata spoofing. They specifically titled the commit "Switched DataConverter to OrchestrationContext [skip ci]" and backdated the commit timestamp to appear as if it were a routine, harmless update from March 9, 2020. This deceptive packaging allowed the malicious code to blend seamlessly into the repository's extensive commit history.[2][4]

Hidden within this seemingly innocuous commit were heavily obfuscated configuration files designed to exploit the AI tools' context-gathering behaviors. The payload included a modified .github/setup.js script, specialized workspace task files for Visual Studio Code, and poisoned mcp.json settings used by Model Context Protocol servers. These files were not standard application code; rather, they were environment instructions that modern IDEs are programmed to read and execute automatically in order to prepare the workspace, making them the perfect trojan horse for the Miasma worm.[2][5]

When a developer opened the compromised Azure/durabletask repository, their AI coding tool immediately began parsing these configuration files to understand the project's structure, dependencies, and required context. This routine, automated action inadvertently triggered the execution of the hidden JavaScript payload in the background. Because the execution was initiated by a trusted application—the developer's own IDE—and occurred entirely outside the context of a package manager, traditional dependency auditing tools and static code analyzers failed to flag the activity, allowing the malware to run unimpeded.[1][6]

Once the initial execution phase was successfully triggered, the payload initiated a complex sequence to establish a foothold on the victim's machine. It dynamically reached out to external servers to download a version of the Bun JavaScript runtime specifically tailored to the victim's operating system—seamlessly adapting to Linux, macOS, or Windows environments. By bringing its own runtime, the malware ensured it could execute its secondary, more aggressive stage without relying on the host machine's existing Node.js installation, further complicating detection efforts.[1]

The primary objective of this secondary payload was exhaustive, rapid credential harvesting. The malware systematically scoured the developer's local machine for highly privileged access tokens that could be used to pivot deeper into enterprise networks. The scanning scope was vast, targeting Azure service principals, AWS access keys, Google Cloud Platform service accounts, Kubernetes cluster secrets, HashiCorp Vault credentials, GitHub Personal Access Tokens, and personal SSH keys. By capturing these keys, the attackers gained the ability to impersonate the developer across virtually all corporate cloud infrastructure.[2][3]

To exfiltrate this massive trove of stolen data without triggering network security alarms or endpoint detection systems, Miasma employed a highly novel Command and Control (C2) strategy. Rather than sending data to a suspicious external IP address, the worm used GitHub's own Commit Search functionality as a covert communication channel. By encoding the stolen credentials and passing them through legitimate GitHub API requests, the outbound traffic appeared as standard developer activity to enterprise firewalls, rendering the entire exfiltration process virtually invisible to traditional network-layer monitoring.[1]

The potential blast radius of this credential harvesting campaign was catastrophic, given the widespread use of the targeted Microsoft repositories. However, GitHub's automated abuse detection systems identified the anomalous repository behavior and intervened almost immediately. In a sweeping automated enforcement action, the platform issued Terms of Service violations and locked down all 73 affected repositories within a two-minute window. This rapid, automated quarantine prevented the malicious configurations from being pulled down by thousands of downstream developers, effectively halting the worm's spread through official Microsoft channels.[4]

This high-profile incident was not an isolated event, but rather the culmination of a rapidly evolving and highly aggressive campaign by TeamPCP. Just days earlier, on June 1 and June 3, earlier variants of the Miasma worm had successfully compromised dozens of RedHat-affiliated packages and major AI SDKs on the npm registry. During those earlier waves, the attackers utilized a technique dubbed "Phantom Gyp," which abused native C++ binding files to trigger execution during installation, proving the group's relentless focus on bypassing conventional supply chain defenses.[1][6]

The threat landscape darkened significantly on June 9, when an unknown threat actor publicly open-sourced the complete Miasma toolkit on the internet. The released source code revealed a highly modular architecture with payloads explicitly designed to target 15 different AI coding agents, along with persistence mechanisms capable of surviving standard credential rotations. By making this sophisticated, per-infection encrypted malware available to the broader cybercriminal community, the release significantly lowered the barrier to entry, virtually guaranteeing a surge of derivative supply chain attacks in the coming months.[5]

The Miasma incident represents a fundamental paradigm shift in software development security. As AI programming tools become deeply integrated into daily engineering workflows, repository configuration files can no longer be treated as passive preference settings. They are now highly capable, executable delivery paths for attack payloads. This reality requires the cybersecurity industry to apply strict zero-trust principles not just to production servers, but to the local development environments themselves, ensuring that AI agents operate within secure sandboxes that cannot silently leak the keys to the kingdom.[6]