Miasma worm compromises 73 Microsoft GitHub repositories via AI code editors
A self-replicating worm called Miasma compromised 73 Microsoft GitHub repositories by exploiting AI code editor tools like Claude Code and Cursor. The attack stole cloud and API credentials by executing when developers opened infected repositories, then self-propagated across accessible repositories using compromised credentials.
What happened
A supply chain attack compromised 73 GitHub repositories belonging to Microsoft organizations (Azure, Azure-Samples, Microsoft, and MicrosoftDocs) using a worm called Miasma, a variant of Mini Shai-Hulud published by TeamPCP in May 2026. The attack chain involved compromising a Red Hat employee's GitHub credentials detected in infosstealer logs since April 2026, then making malicious commits titled 'chore: update dependencies [skip ci]' containing a 4.3 MB runner payload.
The worm was uniquely designed to execute when developers opened repositories in AI code editors: Claude Code, Gemini CLI, Cursor, VS Code, and npm test scripts. GitHub disabled the affected repositories within 105 seconds of detecting the threat. The attack used a technique called 'Phantom Gyp,' abusing a 157-byte binding.gyp file to trigger code execution during installation, evading typical npm security scanners that monitor preinstall and postinstall scripts.
Reported impact
Once executed, the Miasma worm harvested credentials from multiple cloud providers including AWS, Azure, GCP, Kubernetes, npm, and GitHub, uploading stolen tokens to public repositories created on-the-fly. The worm then self-propagated by making malicious commits to all repositories accessible with the compromised developer's write permissions.
Affected repositories included critical Azure infrastructure projects such as azure-search-openai-demo, durabletask and its implementations in .NET, Go, JavaScript, and MSSQL, functions-container-action, and windows-driver-docs. The malware was specifically designed to steal credentials for Claude and Gemini AI assistants.
Index analysis
This was the first documented attack at scale using AI code editor agents as an execution vector, marking a significant shift in supply chain attack methodology. The campaign represented the third Miasma attack in one week, following compromise of 32 packages in the @redhat-cloud-services namespace on npm on June 1.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.