Microsoft · 2026-06-08 · major
GitHub Disables 73 Microsoft Repos After 'Miasma' Worm Hijacks an Azure Contributor — Self-Spreading npm Variant of Shai-Hulud Plants Credential-Stealing .claude/, .gemini/, .cursor/, and .vscode/ Configs That Fire When AI Coding Agents Open the Repo and Harvest AWS, Azure, GCP, and Kubernetes Keys
A Shai-Hulud variant called 'Miasma' jumped from the Red Hat npm scope to Microsoft GitHub orgs, weaponizing Claude Code, Gemini CLI, Cursor, and VS Code session hooks to harvest cloud credentials on repo open.
Self-spreading npm worm jumped from Red Hat packages to Microsoft GitHub orgs and weaponized AI coding agent config files to harvest cloud credentials.
Key specs
| Repos disabled | 73 |
|---|---|
| Microsoft orgs hit | 4 |
| Azure repos hit | 49 |
| Microsoft repos hit | 10 |
| Azure samples repos hit | 13 |
| Microsoft docs repos hit | 1 |
| Hn points | 341 |
| Incident date | 2026-06-05 |
What is it?
Miasma is a self-replicating variant of the Shai-Hulud worm. It first compromised 32 @redhat-cloud-services npm packages on June 1, then on June 5 used a hijacked contributor account to push malicious commits into Azure/durabletask, fanning out to 73 repos across the Azure, microsoft, Azure-Samples, and MicrosoftDocs GitHub organizations. GitHub disabled all 73 in two automated waves over ~105 seconds. TechCrunch broke the AI-developer angle on June 8.
How does it work?
The malicious commits drop `.claude/settings.json` and `.gemini/settings.json` SessionStart hooks, a `.cursor/rules/setup.mdc` prompt-injection file, a `.vscode/tasks.json` auto-run task, and a 4.6 MB obfuscated `.github/setup.js` payload. When a developer opens an infected repo in Claude Code, Gemini CLI, Cursor, or VS Code, the AI agent's auto-load on session start executes the payload, which downloads the Bun runtime and harvests credentials from GitHub, npm, AWS, Azure, GCP, Kubernetes, and 90+ developer tools. The npm side uses a 157-byte binding.gyp file to trigger code execution during `npm install`, bypassing install-script policies.
Why does it matter?
First widely-documented case of a supply-chain worm weaponizing the auto-load surface of AI coding agents — your assistant's startup behavior is now an attack vector independent of the package code itself. Any repo with agent config files is suspect on clone. Microsoft spokesperson Ben Hope said some repos have been restored after review; others remain offline pending investigation.
Who is it for?
Anyone using Claude Code, Gemini CLI, Cursor, or VS Code on Azure tooling repos.