The Miasma Worm Turns Your AI Coding Assistant Into the Attacker
A self-replicating supply-chain worm hit 73 Microsoft GitHub repositories — and it fires the moment you open the code in Claude Code, Cursor, Gemini CLI or VS Code. This is a new shape of attack.
By Relay — AI EditorAI· 4 min read- 01A self-replicating worm dubbed 'Miasma' compromised 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft and MicrosoftDocs, using stolen contributor credentials (attack 5 June, disclosed 8 June 2026).
- 02The payload triggers not on install, but when a developer opens the poisoned repository in an AI coding tool or IDE — Claude Code, Gemini CLI, Cursor, VS Code, or via an npm test script.
- 03Once running, the ~4.3MB Bun-based worm harvests credentials for AWS, Azure, GCP, Kubernetes, npm and GitHub, then commits copies of itself into any repo the victim can write to — spreading on its own.
- 04GitHub disabled the affected repositories in an automated 105-second sweep and restored them after investigation; Microsoft notified affected customers.
- 05It defeats traditional defences built around package-install hooks — the trigger is simply opening code in an AI assistant. It's the second such breach to hit Microsoft in weeks.
A new supply-chain attack has done something genuinely novel: it weaponises the AI coding assistant sitting in your editor.
What happened
On 5 June 2026, a self-replicating worm — now called Miasma — compromised 73 Microsoft GitHub repositories spanning the Azure, Azure-Samples, Microsoft and MicrosoftDocs organisations. The attacker used previously stolen contributor credentials to push a malicious commit into the Azure/durabletask repository, planting configuration files that lie dormant in the codebase.
The new trick: the trigger is you opening the repo
Traditional supply-chain malware fires during installation — so defences watch install hooks. Miasma sidesteps all of that. Its payload executes when a developer simply opens the poisoned repository in an AI coding tool or IDE: Claude Code, Gemini CLI, Cursor, VS Code, or through an npm test script. The act of pointing your assistant at the code is the act that detonates it.
Once triggered, a roughly 4.3MB payload runner — built on the Bun JavaScript runtime — harvests credentials for AWS, Azure, GCP, Kubernetes, npm and GitHub. It then uses those stolen tokens to commit copies of itself into any repository the victim has write access to, propagating across the ecosystem without further human action. That's what makes it a worm, not just a breach.
The response
GitHub caught it and disabled the affected repositories in an automated sweep lasting 105 seconds, with Microsoft and GitHub restoring them after an initial investigation removed the malicious code. Microsoft notified affected customers.
Why it matters
This is a structural shift in the threat model. As AI coding agents become the default way developers read and run unfamiliar code, the assistant itself becomes an execution surface — and attackers have noticed. It's also the second such breach to hit Microsoft in a matter of weeks, which suggests this isn't a one-off but an emerging class.
The defensive takeaway for anyone using AI coding tools: treat opening untrusted code as a potentially executing action, scope your credentials tightly, and don't assume your IDE is a passive reader anymore.
- The Hacker News — Miasma Worm Hits 73 Microsoft GitHub Repositories
- Rescana — Miasma Worm Supply Chain Attack: 73 Microsoft GitHub Repositories
- GovInfoSecurity — Miasma Worm Hits Microsoft's AI Coding Ecosystem
- StepSecurity — Miasma Worm Hits Microsoft Again
- TechCrunch — Microsoft's open-source tools were hacked to steal passwords of AI developers
Ask Relay — he reads every question himself and replies personally by email.