TL;DR

The Miasma worm affected 73 Microsoft GitHub repositories in Azure and Microsoft organizations. It installs payloads designed to activate inside AI coding tools including Claude Code and Cursor.

The self-replicating Miasma worm reached Microsoft GitHub repositories directly. GitHub suspended 73 repositories spanning four Microsoft organizations, including Azure, Azure-Samples, Microsoft, and MicrosoftDocs, after the worm inserted malicious code that steals developer credentials. This marks the largest expansion so far in a supply chain attack that has moved through the open-source community for weeks.

The campaign used previously stolen credentials. Last month, the group TeamPCP compromised the durabletask package on PyPI within Microsoft Azure organization to distribute an information stealer. Researcher Paul McCarty noted that the same repository featured in this latest action.

When the repository at the center of last month compromise becomes the focus of this month action, it signals the same issue recurring, McCarty stated. The party that obtained those credentials in May likely retained access.

The campaign stands out because of its activation method. Attackers inserted a 4.3 MB payload runner set to launch automatically via five tools: Claude Code, Gemini CLI, Cursor, VS Code, and the npm test script. A developer only needs to clone an affected repository and load it in an AI coding agent for the malware to execute.

After activation, the Bun-based worm collects credentials for AWS, Azure, GCP, Kubernetes, npm, and GitHub. It then uses the tokens to push copies of itself into any repositories the victim can modify, allowing autonomous spread through the ecosystem.

Disabled repositories include key Azure projects such as azure-search-openai-demo, durabletask along with its .NET, Go, JS, and MSSQL versions, functions-container-action, llm-fine-tuning, and windows-driver-docs. OpenSourceMalware indicated GitHub contained the incident within 105 seconds, though the extent of impact on downstream users is still unknown.

Miasma represents a variant of the Mini Shai-Hulud worm that TeamPCP released publicly in mid-May 2026. The original Shai-Hulud emerged in September 2025 as the first self-replicating malware seen in the npm ecosystem. It has since evolved across npm and PyPI, earlier affecting 32 Red Hat packages and striking TanStack, Mistral AI, and UiPath packages.

The worm has started bypassing the npm registry. SafeDep observed it inserting malicious code straight into source repositories, including icflorescu/mantine-datatable and four related projects. At present, more than 80 public GitHub repositories show the Miasma campaign naming pattern.

The core issue lies not in a flaw within npm or GitHub. It takes advantage of the trust model these platforms rely upon, according to security firm FalconFeeds.io. The assumption that a package signed with a valid key and released by an authenticated maintainer must be safe no longer holds. The worm takes control of the key and the maintainer, then behaves exactly like a legitimate publisher. From the registry viewpoint, every malicious publish appears as a normal update.

The focus on AI coding agents marks a clear shift. Developers now depend more on tools like Claude Code and Cursor when working with unfamiliar repositories. A worm that activates upon an AI agent opening a project takes advantage of usage patterns that emerged only recently. This represents supply chain malware built for AI-assisted development.