SAN FRANCISCO — The malware waited inside configuration files that looked routine. A Claude settings file, a Cursor rule, a VS Code task — each harmless on its own, each designed to be ignored. The payload only woke up when a developer opened the infected repository inside an AI coding tool, at which point it set about stealing credentials from the machine it had just entered.
On June 5, GitHub disabled 73 repositories across four Microsoft organizations after a malicious commit landed in the Azure/durabletask repository using a previously compromised contributor account, according to security firm StepSecurity, which documented the incident. The takedowns came in two waves over 105 seconds, a response automated enough to suggest the platform recognized the attack pattern. The affected projects spanned Azure Functions runtime components, language workers, extension bundles, Durable Task SDKs and AI-related samples. Users who tried to open the repositories saw a notice that access had been disabled “due to a violation of GitHub’s terms of service.”
The attack vector marks a departure from the usual supply-chain playbook. Instead of poisoning a package that developers install, the attackers planted files that execute when a repository is opened in an AI agent — Claude Code, Gemini CLI, Cursor or VS Code. The malicious payload, a 4.6-megabyte obfuscated JavaScript file, harvests credentials from AWS, Azure, Google Cloud, Kubernetes clusters, password managers and more than 90 developer tool configurations, according to Cloudsmith and OpenSourceMalware, which first flagged the campaign. The worm, which researchers track as Miasma, then spreads laterally, using stolen permissions to commit malicious code to other repositories its victims can write to, and exfiltrating data by creating new public repositories.
The technique exploits a blind spot in security tooling. Most package scanners watch for suspicious preinstall or postinstall scripts, but the malicious code here triggers during the build phase through a binding.gyp file, a method researchers have dubbed “Phantom Gyp.” Because the files are loaded automatically by AI tools that are explicitly granted broad permissions to read and execute code, the assistant becomes the delivery mechanism. Researchers described it as the first documented case of AI coding agents being used as a primary, large-scale execution vector.
The breach is the second to hit Microsoft’s open-source account in weeks. In mid-May, the durabletask Python SDK on PyPI was compromised, with a 28-kilobyte payload that stole credentials and spread through cloud infrastructure, an attack linked to a threat actor tracked as TeamPCP. That package receives about 400,000 downloads a month. OpenSourceMalware described the June incident as a “re-compromise” of the same project, suggesting the original credentials were never fully rotated. The same campaign also poisoned dozens of Red Hat packages, and the attackers abused a legitimate Microsoft OpenID Connect token to authenticate as Microsoft, StepSecurity said.
Microsoft confirmed the takedown but gave little detail. “We have temporarily removed some repositories as we investigated potential malicious content,” Ben Hope, a Microsoft spokesperson, told TechCrunch. “Some of these repos have been restored after review, while others may remain offline while work continues.” The company said it notified a small number of customers who may have pulled content from the affected repositories.
The campaign reflects the rising value of AI development infrastructure as a target. Coding agents from Anthropic, OpenAI and Google have become standard tools on developer workstations, and they are granted broad permissions by design: they read files, execute commands and manage credentials. Attackers who compromise the code those agents process gain access to everything the agent can see. The Microsoft incident follows a line of supply-chain attacks that have escalated in sophistication, from the SolarWinds compromise of 2020, which rode on a trusted software update, to the XZ Utils backdoor attempt of 2024, which hid a payload in a compression library relied on by nearly every Linux system. The Miasma campaign’s innovation is the delivery channel: instead of poisoning a package, it poisons the configuration files that AI agents load automatically, turning the developer’s own assistant into the infection vector. Because the malicious files carry no executable signature until the agent interprets them, conventional malware scanning provides little protection.
The practical damage extends beyond the stolen tokens. Workflows that referenced Azure/functions-action, the official GitHub Action used to deploy Azure Functions, broke when the repository went dark, disrupting developer pipelines. Security researchers advised anyone who cloned the affected repositories after June 2 and opened them in an AI coding tool to treat their systems as compromised: rotate GitHub tokens, SSH keys, cloud credentials and CI/CD secrets, and audit repository histories for unauthorized commits.
The attack is among the most widespread open-source supply-chain incidents since the SolarWinds compromise, analysts said, and it signals where attackers are heading next. AI development tools hold privileged access to code, credentials and cloud infrastructure by design, which makes them the most valuable target in the software supply chain. The industry’s response so far — credential rotation and repository review — addresses the symptoms. The underlying design question, of how much access AI agents should have by default, remains open.
