A self-replicating worm known as Miasma has turned AI coding assistants into malware triggers, marking a dangerous escalation in supply chain attacks.
On June 5, 2026, GitHub disabled 73 Microsoft repositories after the Miasma campaign compromised the Azure/durabletask project using stolen contributor credentials.
The attack affected repositories across four major Microsoft organisations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs, in an automated disablement lasting just 105 seconds.
GitHub’s response took down critical Azure infrastructure projects including azure-search-openai-demo, durabletask and its .NET, Go, JS, and MSSQL implementations, functions-container-action, and llm-fine-tuning.
Researchers at SafeDep documented Miasma planting payloads that fire when a developer opens an affected project in Claude Code, Cursor, Gemini CLI, or VS Code.
Rather than modifying source code, five files were added to trigger automatic execution of a 4.3 to 4.6 MB obfuscated JavaScript payload upon opening the repository in developer tools.
The attack represents a significant shift from traditional supply chain defences, which have historically focused on package install hooks rather than editor-level configuration files.
“The attack detonates when a developer clones one of the affected repos and opens it in an AI coding agent,” SafeDep said, describing the technique found across multiple compromised repositories.
Once executed, the payload hunts for cloud keys from Amazon Web Services, Google Cloud Platform, and Microsoft Azure, as well as GitHub Actions secrets and local password stores including 1Password, gopass, and pass.
Stolen credentials flow to a dead-drop GitHub account, liuende501, which researchers found hosting 236 repositories built to receive encrypted credential files.
The same fingerprint appears across more than 120 repositories, including the official Azure/durabletask repository with 1,718 stars, where the attacker backdated a commit to 2020 to hide in a dormant branch.
Miasma is assessed by Akamai to be a variant of the Mini Shai-Hulud worm, which the group known as TeamPCP released publicly in mid-May 2026.
The original Shai-Hulud first appeared in September 2025 as the first self-replicating malware observed in the npm ecosystem, and has since spread across npm and PyPI.
Previous targets include TanStack, Mistral AI, UiPath, LiteLLM, Telnyx, Checkmarx, and 32 Red Hat packages, with TanStack’s compromise assigned CVE-2026-45321 at a CVSS score of 9.6.
Security researcher Paul McCarty, who tracks the campaign as 6mile, drew a direct line between the May and June incidents: “A month later, not only is Azure/durabletask gone, so is every sibling repo in the Durable Task ecosystem.”
Socket is now tracking 448 affected artifacts across npm and PyPI, with the campaign operating continuously since June 1, 2026, pivoting delivery mechanisms every 48 to 72 hours with zero CVEs assigned.