AI Coding Tools as Attack Vectors: Has the Miasma Worm Changed How You Work

[DiamondDallas_X]

The Miasma worm campaign that hit 73 Microsoft GitHub repositories on 5 June was not a typical supply chain attack and the community has not fully processed what makes it different. Previous supply chain attacks poisoned package registries, npm packages, PyPI wheels, the usual vectors. Miasma's third wave did something architecturally novel: it planted configuration files that trigger automatic credential harvesting when a developer opens a repository in an AI coding tool. The .claude/settings.json file embedded a Claude Code SessionStart hook. Similar files targeted Gemini CLI, Cursor and VS Code. The attack was not about what code gets installed. It was about what happens the moment an AI coding assistant boots up in a compromised directory.

This represents a meaningful shift in threat model for anyone using agentic coding tools. Claude Code, Gemini CLI and similar tools request broad permissions to read directories, execute commands, manage files and interact with APIs. That is what makes them useful. It is also exactly what makes a SessionStart hook so effective as an attack vector. The attacker does not need the developer to run anything. They need the developer to open the repository. TeamPCP, the group behind Miasma, has now hit TanStack via npm, Mistral AI's packages, the antv ecosystem with 639 compromised versions, and now Microsoft's Azure GitHub organisations. The campaign has infected over 113 repositories across dozens of accounts according to StepSecurity. This is a sustained, sophisticated, and evolving threat.

Have you changed how you use AI coding tools since this came out? What does secure use of agentic coding assistants actually look like in practice?

[WaveFunction34]

I added a manual review step before opening any repository in Claude Code that I have not personally initialised. It adds friction but the SessionStart hook attack makes automatic trust of any repo genuinely dangerous

[DarkMatter23]

The most unsettling thing is that this attack specifically targets AI coding tools because those tools have the permissions to do real damage. The better these tools get, the more valuable they become as attack targets

[Coastal Estuary]

Pinning dependencies to exact commit SHAs rather than floating versions should be standard practice at this point. The Miasma campaign is the fourth major reason to do that in 2026 and people are still not doing it

[ThreadNecro98]

My team has put Claude Code behind a restricted environment where it cannot access cloud credentials directly. The capability loss is real but the attack surface is much smaller. Not ideal but the alternative is worse

[RomanReigns26]

The fact that the same compromised contributor account ran both the May PyPI attack and the June GitHub attack tells you GitHub's contributor account security model has a gap that TeamPCP found and is exploiting systematically

[Dataset Cheetah]

I wonder how many developers had credentials harvested during the exposure window without knowing it. GitHub disabled the repos in 105 seconds but Miasma was active in that window. The damage assessment has not been published

[ProperJobs98]

This is the inevitable consequence of giving AI coding tools broad system access. We made these tools powerful by design and now that power is being weaponised against us. There is no clean solution

[Henry25]

Rotating all CI/CD secrets from the May 20 to June 5 window is the advice being given. For large organisations that is a massive operational exercise. Has anyone actually done it or is everyone hoping they were not affected

[SharpFox]

The targeting of both Claude Code and Gemini CLI in the same attack package tells you the attacker has reverse-engineered both tools' configuration systems carefully. This was not opportunistic

[Backprop Python]

What I want to know is whether Anthropic and Google are updating their tools to warn users when repository configuration files try to set up hooks on session start. That seems like an obvious defensive measure