Reported by 1 outlet

Timeline

1. original reporting

   Miasma Worm Hits 73 Microsoft GitHub Repositories — Supply Chain Attack Targets AI Coding Agents via Claude Code, Cursor, VS Code Hooks, Azure CI/CD Permanently Broken

   computing.co.uk · 128d ago · June 8th, 2026

   On June 5, GitHub disabled 73 repositories across four Microsoft organizations (Azure, microsoft, Azure-Samples, MicrosoftDocs) in a 105-second automated sweep after a malicious commit was pushed to Azure/durabletask using a previously compromised contributor account — the same account used in the May 19 PyPI attack on the same project.

   How it works: The attacker backdated the commit to 2020-03-09 and used [skip ci] to evade CI detection. The commit planted zero source code changes but added five files — four configuration files and one 4.6 MB obfuscated JavaScript credential harvester (setup.js). Each config file targets a different execution trigger:

   • Claude Code & Gemini CLI: A SessionStart hook in .claude/settings.json executes node .github/setup.js automatically when an AI session opens in the repo directory — no explicit invocation required.

   • Cursor AI: A .cursor/rules/setup.mdc file with alwaysApply: true tells the agent to run the payload as a "project setup requirement."

   • VS Code: A .vscode/tasks.json entry with "runOn": "folderOpen" triggers execution when the folder is opened in VS Code — no AI agent needed.

   • npm: A preinstall script in package.json fires during npm install.

   The payload: Once triggered, the Bun-based worm harvests credentials for AWS, Azure, GCP, Kubernetes, npm, and GitHub, then uses those stolen tokens to propagate itself into any repository the victim can write to — spreading autonomously across the ecosystem. The credential harvester also targets AI coding tool configurations (Claude Code, Cursor, VS Code settings).

   Impact: Azure/functions-action@v1 — the official GitHub Action for deploying Azure Functions — was among the disabled repos, breaking CI/CD pipelines globally. Microsoft characterized the incident as an "internal management issue." Organizations relying on the action were forced to migrate to Azure CLI, Azure DevOps Pipelines, or Zip Deploy. Affected projects include durabletask (.NET, Go, JS, Java, MSSQL implementations), azure-functions-host, azure-webjobs-sdk, language workers across 7 stacks, azure-search-openai-demo, and windows-driver-docs.

   Campaign context: Miasma is a rebrand of Mini Shai-Hulud, whose source code was open-sourced by the TeamPCP threat group in May 2026. This is the same worm that compromised 32 @redhat-cloud-services npm packages on June 1. Unlike earlier Shai-Hulud strains (which targeted AWS/GitHub credentials), this variant added dedicated Azure and GCP credential collectors and shifted from "execute on package install" to "execute on folder open" — bypassing traditional supply chain defenses focused on package registry hooks.

   Action: Organizations should (1) audit GitHub repositories for unexpected .claude/, .cursor/, .vscode/ configuration files or setup.js payloads, (2) block SessionStart hooks for Claude Code/Gemini CLI in shared repos, (3) search for unexplained public repos described as "Miasma: The Spreading Blight," and (4) consider this a watershed moment for supply chain security — the attack surface for AI coding agents now includes every repository a developer opens.

   ---