Miasma Worm Compromises 73 Microsoft Azure GitHub Repos in AI Coding Agent Attack

The Miasma self-replicating supply chain worm has reached Microsoft's own GitHub infrastructure, compromising 73 repositories across four of the company's core GitHub organisations and forcing GitHub staff to disable access to the affected codebases. The impacted organisations are Azure, Azure-Samples, Microsoft, and MicrosoftDocs. Attempting to access affected repositories such as Azure/azure-functions-host now returns a notice confirming disablement due to a terms of service violation. Researchers at OpenSourceMalware confirmed the full scope of the incident, which includes repositories central to distributed task infrastructure: durabletask, durabletask-dotnet, durabletask-go, durabletask-js, functions-container-action, and llm-fine-tuning, among others.

What makes this escalation particularly significant is the re-compromise of the durabletask PyPI package, which was previously infected by threat actor group TeamPCP in May 2026 to deliver an information stealer on Linux systems. Security researcher Paul McCarty has observed that the recurrence points strongly to persistent credential access: the original breach was never fully remediated.

How Miasma operates

Miasma is a variant of the Mini Shai-Hulud worm, which TeamPCP publicly released in mid-May 2026. It operates entirely within legitimate platform channels rather than exploiting technical vulnerabilities in npm or GitHub's infrastructure. The worm compromises a package maintainer's signing credentials and then publishes malicious updates through fully authenticated channels, making each malicious publish event indistinguishable from a routine package release.

In the latest campaign variant, Miasma bypassed the npm registry entirely for certain targets, pushing malicious code directly to GitHub source repositories. A 4.3 MB payload runner was planted in the icflorescu/mantine-datatable repository and configured to execute automatically through five developer tools: Claude Code, Gemini CLI, Cursor, VS Code, and the npm test script. The attack triggers the moment a developer clones an affected repository and opens it in an AI coding agent.

The worm continues to mutate. Newly created public repositories containing stolen secrets have appeared under several naming patterns, including "Miasma: The Spreading Blight" and "Hades - The End for the Damned."

GCC and MENA DevOps exposure

Organisations across the GCC that rely on Azure Functions, Azure Durable Task, or Microsoft-published npm packages for application development and deployment pipelines are directly affected. Any developer who has recently cloned from the affected repository list should treat their local environment as potentially compromised and audit recently executed scripts. Enterprise development teams should immediately verify integrity of dependencies against known-clean package versions, review CI/CD pipeline logs for unexpected execution events, rotate any credentials stored in development environments, and restrict AI coding agent access to known-clean repository snapshots until the situation stabilises.

The broader pattern is one the industry must take seriously: supply chain attacks targeting developer tooling have now compromised both npm infrastructure and Microsoft's own open-source estate within the same campaign cycle.