A supply chain worm called Miasma has compromised 73 Microsoft GitHub repositories across four Microsoft organisations — Azure, Azure-Samples, Microsoft, and MicrosoftDocs — and it did so without exploiting a single vulnerability. No zero-day. No exploit signature. Just valid credentials and authenticated maintainer access.

Miasma is a variant of Mini Shai-Hulud, first deployed by threat group TeamPCP in May against the durabletask PyPI package. The June campaign returned to that same package — suggesting TeamPCP never lost access after the initial compromise — and expanded dramatically in scope. The 4.3 MB payload runner was injected directly into infected repositories, bypassing npm registry scanning entirely.

What makes this campaign structurally significant is the execution trigger. The payload detonates when a developer clones an infected repo and opens it in an AI coding assistant: Claude Code, Gemini CLI, Cursor, or VS Code, or during npm test runs. This is the first documented case of malware deliberately weaponising AI coding agents as an execution context — an attack surface that simply didn't exist two years ago.

The downstream exposure is unquantified. Production environments pulling durabletask or mantine-datatable packages before the takedown may have received the payload with no visible indicator. The full scope of compromised credentials remains unconfirmed.

For security teams: audit your dependency tree for durabletask and mantine packages pulled before the takedown, watch for Microsoft's credential-scope disclosure, and treat AI coding agent integrations as a threat surface requiring formal policy. Across npm and GitHub, roughly 95 repositories have now been compromised in connected campaigns. The open-source trust model has no detection layer for maintainers operating normally on stolen credentials.

This episode includes AI-generated content.