🕵️ Miasma worm

The items that name it 13

• StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines
  articleas threat actors2026-10-08

  Used a compromised contributor account to push a commit into a Microsoft repository in June; the commit changed no source code but planted configuration files that run a credential-harvesting payload when a developer opens the repository in Claude Code, Gemini CLI, Cursor, or VS Code. The commit car

• Top 10 attacks on Claude Code and what each one actually broke
  writeupas threat actors2026-09-23

  Supply-chain worm/campaign; on June 5, 2026 used a compromised contributor account to push a commit to Azure/durabletask planting configuration files (including a .claude/settings.json SessionStart hook) that executed a credential-harvesting payload the moment a developer opened the repository in Cl

• Shai-Hulud was the best thing to happen to supply chain security
  articleas classification.key entities2026-08-24
• The State of Open Source Supply Chain Attacks
  articleas threat actors2026-08-23

  Worm that forced Microsoft to disable the Azure Functions Action and 72 other repositories in June 2026; resurfaced in July 2026 inside the AsyncAPI ecosystem; specifically targeted AI coding agents; spread by planting workflows with stolen developer credentials until Microsoft disabled 73 repositor

• And another one. GitHub ships break-glass credential revocation
  articleas classification.key entities2026-07-01
• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas classification.key entities2026-06-18
• The OpenSourceMalware Show #8
  talkas threat actors2026-06-11

  Worm that compromised and disabled 73 Microsoft GitHub repositories on June 5th within 105 seconds; based on TeamPCP's open-sourced MiniShai Hulud worm; initial foothold traced to a May 19th compromise of the Durable Task repo, with threat actors maintaining persistence via stolen credentials before

• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeupas threat actors2026-06-09

  Self-propagating worm campaign that compromised the Azure/durabletask GitHub repository a second time on June 5, 2026, disabling Azure Functions and 72 other repositories; targets AI coding agents (Claude Code, Gemini CLI, Cursor, VS Code)

• Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents
  writeupas classification.key entities2026-06-09
• Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter
  writeupas threat actors2026-06-09

  Related Shai-Hulud campaign incident targeting Microsoft Azure repositories, previously analyzed by StepSecurity.

• Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds
  writeupas classification.key entities2026-06-06
• The OpenSourceMalware Show #7
  talkas classification.key entities2026-06-03
• Open Source Malware Podcast — episodes
  otheras threat actors2026-05-22

  Worm that disabled 73 Microsoft GitHub repositories in 105 seconds on June 5th across four GitHub orgs including Azure Functions; also hit Red Hat starting June 1st with 32 @redhat-cloud-services packages compromised, expanding to 80+ packages and 286+ malicious packages