Miasma Worm Hits 73 Microsoft GitHub Repos via AI Coding Tools

[Odd Voyager]

Should Claude Code Users Be Worried?
A supply chain attack called the Miasma worm reached Microsoft's Azure GitHub organisations on 5 June, and the attack vector is genuinely novel in a way that should concern everyone using AI coding assistants. A previously compromised contributor account pushed a malicious commit to the Azure/durabletask repository. The commit planted five configuration files specifically designed to trigger credential harvesting when a developer opens the repository in Claude Code, Gemini CLI, Cursor or VS Code. One of those files was .claude/settings.json, embedding a Claude Code SessionStart hook so the payload fires automatically when a coding session begins. GitHub's automated abuse detection disabled 73 repositories across four Microsoft organisations in a 105-second sweep, but not before Azure/functions-action, the official GitHub Action for deploying Azure Functions, went dark and broke CI/CD pipelines globally.

The broader context is that Miasma is a variant of the Mini Shai-Hulud worm released by the TeamPCP threat group in mid-May 2026. The same compromised contributor account was used in a May attack on PyPI packages. Between June 5 and June 7 a second wave dropped 37 malicious Python wheel artifacts across 19 PyPI packages. StepSecurity who uncovered the attack said developers who opened any of the affected repositories in Claude Code or Gemini CLI during the exposure window may have had credentials harvested. Any CI/CD pipeline that ran between May 20 and June 5 should be treated as potentially compromised and all secrets rotated. Microsoft confirmed the incident but said only that they had temporarily removed repositories while investigating.

Are AI coding tools creating a new category of supply chain risk that we are not adequately defending against yet? What should developers be doing differently right now?

[Lazy Sentinel]

The SessionStart hook in Claude Code is the most alarming detail here. The attacker did not need the developer to run anything manually. Opening the repo was enough. That is a fundamentally different threat model

[SpikeDudley88]

This is what happens when AI coding tools get deep integration with the filesystem and execution environment. The capability that makes them useful is exactly what makes them a perfect attack surface

[Ava_75]

Rotating all secrets from every pipeline that ran after May 20 is going to be a painful exercise for organisations that used Azure Functions action. That is a huge number of production deployments

[MurkyInlet]

GitHub disabling 73 repos in 105 seconds is impressive automated response. The problem is the window between malicious commit and detection where credentials are being harvested in real time

[ForumGremlin93]

The fact that the same compromised account was used in the May PyPI attack and the June GitHub attack suggests Microsoft's contributor account management has a gap that TeamPCP knew how to exploit

[Tracey]

Using a legitimate contributor account rather than a new account is a classic supply chain technique. It bypasses the obvious checks because the committer has real trust history in the repository

[BankHolidayBlues]

I pinned all my dependencies to exact commit SHAs after the TanStack compromise in May. The Miasma campaign is exactly why pinning matters. Floating version references in CI/CD are an open door

[FadedKernel]

The attack targeting four different AI coding tools simultaneously suggests TeamPCP did extensive reconnaissance into how each tool handles repository configuration files. This was not opportunistic

[MickFoley]

Does anyone know if the credential harvesting was purely local or if it reached cloud platform tokens as well. Because if Azure service principals were compromised that is a completely different magnitude of damage

[Marcus]

Every organisation running agentic AI coding workflows needs to treat this as a wake-up call about what permissions those agents actually have. Claude Code and Gemini CLI running with broad filesystem access is a significant attack surface

[Jackson79]

The irony of Microsoft's biggest quantum announcement week being overshadowed by 73 of their GitHub repos getting pwned is not lost on me