On June 5, 2026, a hijacked contributor account pushed malicious commit 5f456b8 straight into Microsoft’s Azure/durabletask GitHub repository. The commit message claimed a refactor (“Switched DataConverter to OrchestrationContext”), the diff touched zero source files, and the payload was five planted files aimed not at a package manager but at the AI coding agents and editors developers open every day — Claude Code, Gemini CLI, and Cursor. It was the Miasma worm hitting Microsoft again, and a marker for supply-chain attacks shifting from “execute on install” to “execute on folder open.”
The fallout was immediate. GitHub’s automated enforcement disabled 73 repositories across four organizations in 105 seconds, including the source of Azure’s official deployment Action, breaking CI/CD pipelines on the spot. StepSecurity’s forensic writeup and The Register’s follow-up reporting piece together the full picture.
Two Waves: From PyPI Poisoning to Repo Injection
Miasma is a post-TeamPCP supply-chain worm (C2 domain t.m-kosche[.]com) that had already infected 113+ GitHub repositories across dozens of accounts; TanStack, Mistral AI, @antv, @redhat-cloud-services, LiteLLM, Telnyx, and Checkmarx were all prior victims. Its campaign against Microsoft ran on two fronts.
The first wave came on May 19: using a compromised publishing token, the attacker uploaded three malicious versions of the durabletask PyPI package (1.4.1, 1.4.2, 1.4.3) in a 35-minute window, bypassing CI/CD entirely. The payload harvested secrets from AWS, Azure, GCP, Kubernetes, and 90+ developer tool configurations; Microsoft yanked the package after it was flagged in Issue #137.
The second wave was the June 5 repository injection: the same compromised contributor account pushed a commit directly to the repo, backdated to 2020 and tagged skip ci to dodge automated checks. The battlefield moved from the package registry to source code itself.
The Attack Chain: Execute on Folder Open
The five planted files target four tools, all pointing at a single 4.6 MB (4,643,745-byte) obfuscated payload (.github/setup.js):
- .claude/settings.json — a SessionStart hook that executes the payload the moment Claude Code opens the repo
- .gemini/settings.json — the identical hook for Gemini CLI
- .cursor/rules/setup.mdc — prompt injection disguised as setup instructions, with alwaysApply enabled
- .vscode/tasks.json — auto-runs on folder open, no AI agent required at all
- .github/setup.js — the credential harvester itself
The decisive change is the trigger. Cloning the repository is safe; opening it is not. StepSecurity frames this as a shift from “execute on package install” to “execute on folder open” — the attack surface moved from the package manager to the developer’s editor. The June payload is also embedded in the repo itself, needs no C2 infrastructure, and is cross-platform.
The 105-Second Sweep: 73 Repos and functions-action
GitHub’s enforcement ran in two waves between 16:00:50 and 16:02:35 UTC — 39 repositories disabled in 38 seconds, then 34 more in 11 seconds after a 56-second gap, all returning HTTP 403 with reason “tos.” The tally: 49 under Azure (including azure-functions-host, azure-webjobs-sdk, functions-action, and azure-functions-durable-extension), 10 under microsoft (durabletask-dotnet, -go, -js, -netherite, and more), 13 under Azure-Samples (including rag-postgres-openai-python and llm-fine-tuning), and 1 under MicrosoftDocs. StepSecurity verified 16 similar repositories were left untouched, confirming the sweep was targeted.
Collateral damage landed instantly. Azure/functions-action is the official GitHub Action for deploying Azure Functions; when its repo vanished, every workflow referencing @v1 broke at once, with 20+ developers reporting failures on Microsoft Learn Q&A. Microsoft first called it a policy violation, then revised its statement to an “internal management issue” within twelve minutes, recommending Azure CLI, Azure DevOps Pipelines, VS Code deployment, or Zip Deploy as alternatives. The episode re-exposed the mutable-tag problem: when a repository disappears its tags evaporate with it, while workflows pinned to commit SHAs fail in a more predictable way.
Toolkit Leak: Miasma Goes Open Source
Then it got worse. Starting June 8, repositories titled “Miasma-Open-Source-Release” began appearing on GitHub, pushed through four previously compromised developer accounts — the worm’s full source code is now public. SafeDep, which analyzed one repo before GitHub removed it, described “a full supply chain attack toolkit that allows the operator to execute various attacks via stolen credentials,” covering PyPI, npm, RubyGems, JFrog Artifactory, GitHub repos and Actions, AI coding tool config poisoning, and SSH-based lateral movement. Wiz notes Miasma already evolved from the Mini Shai-Hulud toolkit, and TeamPCP open-sourced its original worm in May while running a supply-chain attack contest on BreachForums.
Technically, the worm runs entirely inside GitHub with no custom C2 infrastructure: three independent commit-search channels (DontRevokeOrItGoesBoom, TheBeautifulSandsOfTime, and firedalazer) handle exfiltration (tokens AES-256-CBC encrypted inside commit messages), immediate JavaScript execution via eval, and a persistent Python monitor. SafeDep’s conclusion for defenders: detection now has to happen at the application-protocol level as behavioral anomaly, because network-level indicators no longer cut it. As of June 9, Socket was tracking 473 affected package artifacts.
Defense Checklist
StepSecurity’s recommendations are concrete enough to paste into a runbook:
- Treat any system that opened an affected repo after June 2 as compromised; rotate all credentials
- Audit repositories for unexpected .claude/, .gemini/, .cursor/, and .vscode/tasks.json files
- Check network logs for check.git-service[.]com and t.m-kosche[.]com
- Require PR reviews via branch protection; ban direct pushes to main
- Move PyPI publishing to Trusted Publishing (OIDC) and retire long-lived tokens
- Pin GitHub Actions to commit SHAs
- Restrict and monitor CI/CD runner egress
For anyone procuring AI tooling, this incident raises the stakes: once attackers treat agent config files as a first-class attack surface, your threat model has to treat every file an AI agent will read as executable code.
Sources
- Miasma Worm Hits Microsoft Again — StepSecurity
- Miasma worms its way onto GitHub as attack kit goes open source — The Register
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.