Overview
On June 5, 2026, 73 of Microsoft’s GitHub repositories were batch-disabled within 105 seconds, triggered when a developer opened a contaminated project folder using VS Code. The attack originated from the Miasma worm, a self-replicating supply chain attack tool operated by TeamPCP. It shifted the attack entry point forward from “triggered during dependency installation” to “triggered upon opening the project”. Executing this step were AI programming tools that developers use daily, such as Claude Code, Gemini CLI, Cursor, and VS Code.
Event Background
The Miasma worm is an evolutionary variant of the Shai-Hulud worm first deployed by TeamPCP in the npm ecosystem in September 2025. After being publicly released in May 2026 as the Mini Shai-Hulud toolkit, it rapidly spread and continuously mutated.
Prior to attacking the Microsoft repositories, Miasma had already completed three waves of progressive attacks:
- Wave 1 (June 1): Poisoned 32 packages under the @redhat-cloud-services namespace via the npm preinstall hook, affecting over 90 versions. Attackers hijacked CI/CD OIDC publishing credentials to push malicious packages with SLSA supply chain integrity signatures into the npm registry.
- Wave 2 (June 3): Switched to the Phantom Gyp technique to trigger code execution during the npm install phase via the binding.gyp file, bypassing most security tools that only inspect preinstall/postinstall hooks, affecting 57 npm packages.
- Wave 3 (June 3 to 5): Completely skipped package managers, pushing malicious commits directly to GitHub source repositories, and triggering payloads through the automated configurations of AI programming tools and IDEs. 73 Microsoft repositories were impacted in this wave.
The attackers did not choose their targets at random. When Microsoft’s durabletask PyPI package was contaminated by the same contributor account on May 19, the credentials had already fallen into the attackers’ hands. On June 5, the attackers used this set of credentials again to push malicious commits to the Azure/durabletask repository. The compromised account’s token had not been rotated for 17 days, or it had already been re-captured by the worm.
Attack Mechanism Analysis
The core innovation of Miasma’s Wave 3 is shifting the attack trigger point from installing dependencies forward to opening the project. A git clone command itself is safe; however, as long as a developer opens the directory in any supported tool, the payload will automatically execute.
The commit pushed by the attackers to Azure/durabletask (commit hash: 5f456b8) possesses several deliberately designed, anomalous characteristics: the commit message claimed to modify DataConverter, but in reality, there were no changes to any source code ; the timestamp was falsified to the year 2020 to evade time-based anomaly detection ; and the [skip ci] flag was appended to the commit message to prevent the CI pipeline from performing automatic scans.
This commit added 5 new files corresponding to 4 different attack entry points. The core payload is .github/setup.js—a 4.6 MB obfuscated JavaScript credential stealer. The purpose of the remaining 4 configuration files is to make different development tools automatically execute this payload under various trigger conditions:
| File Path | Target Tool | Trigger Mechanism |
|---|---|---|
| .claude/settings.json | Claude Code (Anthropic) | SessionStart hook which automatically executes when the session starts |
| .gemini/settings.json | Gemini CLI (Google) | SessionStart hook which structure is completely identical to Claude Code |
| .cursor/rules/setup.mdc | Cursor AI | Prompt injection: alwaysApply: true, inducing the AI Agent to execute the “initialization script” |
| .vscode/tasks.json | VS Code | runOn: folderOpen, automatically triggered when the folder is opened, requiring no AI intervention |
Cursor’s trigger mechanism involves injecting an instruction into the AI Agent via a rule file with alwaysApply: true—ordering it to run setup.js to complete project initialization. The Agent recognizes this as a reasonable project requirement and actively invokes its execution. This is essentially a combination of prompt injection and a supply chain attack: attackers write malicious instructions into the repository configuration, letting the AI complete the final execution step on their behalf.
Once .github/setup.js is executed, credential theft begins immediately. It dynamically downloads the Bun runtime adapted to the current platform (Linux/macOS/Windows) and executes a stage-two payload in the background. The scanning scope covers GitHub Tokens, npm Tokens, AWS/Azure/GCP keys, SSH Keys, Kubeconfig, Docker configurations, as well as shell history and data stored in browsers.
The C2 (Command and Control) infrastructure of this worm runs entirely on GitHub itself: attackers issue commands and receive stolen data through three independent GitHub Commit Search channels, making the entire communication process virtually invisible to traditional network-layer detection tools. After obtaining new credentials, the payload continues to call the /user/repos and /user/orgs APIs to enumerate accessible repositories and push malicious commits to more repositories, completing the next round of propagation.
A dead man’s switch in the payload places a decoy token on the target machine named IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner. If this token is revoked, it directly triggers rm -rf ~/, wiping all data on the developer’s machine. If an administrator discovers an anomaly and revokes this token, they might inadvertently wipe out the developer’s entire machine instead.
AI Programming Tools Become a New Attack Surface
Traditional IDEs act more as text editors, whereas current AI programming tools have evolved into semi-autonomous development agents—they cannot only read code but also actively execute commands, modify files, and call terminals based on project configurations. This automation capability is their core value, and it is precisely what was hijacked by Miasma.
Looking at Claude Code’s SessionStart hook, Gemini CLI’s session initialization mechanism, and Cursor’s alwaysApply rules, the original design goal of these features was to help developers automate project initialization. However, when corresponding configuration files exist in a malicious repository, these efficiency features turn into entry points for executing malicious code automatically.
The attackers did not breach any platform vulnerabilities or exploit any CVEs. Instead, they exploited a deep-seated assumption: if a configuration file exists in a repository, the tool should execute it. This represents a structural flaw in the developer trust model; the higher the degree of automation in AI tools, the larger the blast radius of this flaw.
From the perspective of attack evolution, this represents the fourth stage of supply chain attacks. Attackers no longer wait for code to be downloaded or installed; instead, they wait for developers to open the project. The attack target has shifted from “how code is executed” to “when code is automatically executed by tools”.
Impact Scope
From 16:00 to 16:02 UTC on June 5, GitHub’s automated ban system disabled a total of 73 repositories across four organizations under Microsoft: Azure, Azure-Samples, Microsoft, and MicrosoftDocs, within 105 seconds. The disabled repositories spanned Azure Functions, the Durable Task ecosystem, AI sample projects, connector SDKs, and documentation repositories, including:
- azure-search-openai-demo (Azure OpenAI RAG sample, heavily referenced and deployed by enterprises)
- durabletask and its implementations in .NET, Go, Java, JavaScript, and MSSQL
- functions-container-action (Official GitHub Action for Azure Functions; global CI/CD pipelines were blocked during the ban period)
- llm-fine-tuning, windows-driver-docs, etc.
These parts represent the infrastructure that actual corporate development processes rely upon. While the repositories were disabled, the build pipelines of teams relying on these Actions, SDKs, and documentation were directly disrupted. As of the time of analysis, the active Miasma attacks have cumulatively affected over 473 package artifacts across more than 100 organizations, spanning an attack surface that crosses npm, PyPI, GitHub Actions, and AI tool configurations.
Recommendations
Miasma demonstrates that AI programming tools have become a new entry point for supply chain attacks. For developers, in addition to paying attention to dependency packages and third-party components, they also need to focus on non-code files such as AI tool configurations and automated IDE tasks in repositories, because these configurations can similarly become trigger points for malicious code. Environments that have interacted with affected repositories should promptly audit local configurations and rotate relevant credentials to prevent secondary propagation from ongoing credential leaks.
From an enterprise defense perspective, future supply chain security needs to cover the entire development lifecycle, rather than just the code and artifacts themselves. The automated execution capabilities of AI tools, development terminal permissions, and repository configuration files should all be incorporated into the security governance scope to prevent development efficiency features from being exploited by attackers and becoming new propagation pathways.
Conclusion
The entire execution process of Miasma proceeded along legitimate tracks: legitimate accounts, legitimate commits, legitimate configuration files, and legitimate tool calls. This caused traditional SCA scanning, artifact signature verification, and dependency auditing to fail almost completely.
This case exposes a new phase of supply chain security: once AI programming tools are widely integrated into developer workflows, configuration files in repositories are no longer just project preference settings—they are executable delivery paths for attack payloads.
Development security can no longer stop at dependency package scanning. Its scope needs to extend to developer terminals, AI tool configuration files, automated IDE tasks, credential lifecycles, and repository write governance. Attackers have found a new entryway, and defenders must incorporate this entryway into their threat models.
References
[1] StepSecurity: Miasma Worm Hits Microsoft Again — https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents
[2] The Hacker News: Miasma Worm Hits 73 Microsoft GitHub Repositories — https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html
[3] Microsoft Security Blog: Preinstall to persistence — https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/
[4] The Register: Miasma supply-chain attack toolkit goes public — https://www.theregister.com/cyber-crime/2026/06/09/miasma-supply-chain-attack-toolkit-goes-public-on-github/5253074
