The Miasma self-replicating worm has reportedly impacted 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs. GitHub disabled access to the affected repositories after malicious activity was identified, including repositories connected to the Durable Task ecosystem and Azure-related projects. 

This is not just another open-source supply chain issue. The more worrying part is how the attack works. Instead of relying only on package install scripts, the attackers reportedly planted configuration files that could trigger malicious code when developers opened the repository in tools such as Claude Code, Gemini CLI, Cursor, VS Code, or through npm test workflows.

So now even opening a project in a development tool can become risky. Progress, apparently, means we have taught malware to wait politely inside the workspace.

Why this matters 

Modern development environments are becoming more automated, more connected, and more dependent on AI coding agents. These tools can read files, execute commands, suggest code, run tests, and interact with project configuration. That convenience creates a new attack surface.

Traditional supply chain defenses often focus on package managers, dependency versions, postinstall scripts, and known malicious packages. Miasma shows that attackers can move around those controls by targeting the development environment itself. A malicious repository may not need to compromise the final application. It can target the developer, steal credentials, and spread further through the repositories and platforms that developer can access.

That is a serious shift.

The developer workstation is now part of the supply chain 

Developers usually have access to source code, API keys, cloud credentials, GitHub tokens, npm tokens, SSH keys, CI/CD secrets, Kubernetes configs, and production-adjacent systems. If malware runs inside a developer environment, it may be able to collect secrets and use them to push malicious code into other repositories.

This is why the developer workstation cannot be treated as a casual endpoint anymore. It is part of the software supply chain. If it is compromised, the attacker may not need to break into production directly. They can poison the pipeline upstream and let trust do the rest, because criminals also understand DevOps now, which is deeply annoying but not surprising.

What organizations should do 

Organizations should review repositories for suspicious configuration files, especially files related to AI coding agents, editor tasks, workspace hooks, npm scripts, and automation triggers. Files such as `.claude/settings.json`, `.gemini/settings.json`, `.cursor/rules`, `.vscode/tasks.json`, package scripts, and hidden setup files should not be trusted blindly just because they are inside a repository.

Security teams should enforce least privilege for GitHub tokens, npm tokens, cloud credentials, and CI/CD secrets. Developer credentials should be short-lived wherever possible, and secrets should not be stored locally unless absolutely required. Repository write access should be reviewed, especially for older contributors, automation accounts, and abandoned projects.

Organizations should also monitor for unusual commits, backdated timestamps, `[skip ci]` usage, unexpected configuration files, suspicious repository disabling events, and abnormal GitHub API activity. AI coding tools should be governed like security-sensitive development tools, not treated as harmless assistants with a cheerful interface.

What developers should remember 

Developers should avoid opening unknown repositories directly in powerful AI coding agents or IDEs with auto-run features enabled. Before opening unfamiliar code, inspect configuration files, scripts, hooks, and workspace settings. Auto-run tasks should be disabled unless they are understood and trusted.

Cloning a repository is not always the dangerous part. Opening it inside a tool that automatically executes workspace logic may be. Delightful little distinction, because apparently software development needed more hidden traps.

Security takeaway 

The Miasma worm shows that supply chain attacks are evolving from dependency poisoning to development environment compromise. Attackers are no longer only targeting what gets installed. They are targeting how developers work.

The practical message is simple: secure developer tools, restrict token permissions, inspect repository configuration, monitor unusual commits, and treat AI coding agents as part of the attack surface. As AI-assisted development becomes normal, attackers will keep looking for ways to turn convenience into execution. Defenders need to harden the workflow before the workflow becomes the breach.

Microsoft's GitHub repositories have become the latest to fall victim to the ongoing Miasma self-replicating supply chain attack campaign. The incident impacted 73 Microsoft repositories across four of its GitHub organizations, including Azure, Azure-Samples, Microsoft, and MicrosoftDocs, per OpenSourceMalware. The development has GitHub to disable access to those repositories. "Access to this

Source: Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack via The Hacker News — published 06 Jun 2026.