Inside the Miasma Worm Attack: How Malware Weaponized AI Coding Tools Against Microsoft GitHub

The Origin: The Red Hat npm Compromise

The Microsoft GitHub incident was the final act of a campaign that began days earlier in the open-source software supply chain.

On June 1, 2026, attackers used a stolen Red Hat employee's GitHub account to publish backdoored versions of 32 official @redhat-cloud-services npm packages, spanning over 90 versions . Microsoft Threat Intelligence traced the compromise back to the upstream RedHatInsights/javascript-clients CI/CD pipeline, allowing the attackers to publish trojanized packages with legitimate-looking authentic provenance signatures . These malicious packages carried an obfuscated preinstall script that executed a credential stealer upon installation, laying the groundwork for the wider Miasma propagation .

Response and Containment

The response to the attack was swift and decisive, but the incident's implications run deep.

• Immediate Disablement: GitHub's automated abuse detection systems disabled all 73 infected repositories in two discrete waves, immediately blocking public access and displaying a "terms of service violation" notice .
• Recovery and Remediation: Microsoft fully restored all affected repositories by June 8 and notified impacted customers . A key finding was that the attacker reused unrotated GitHub Actions secrets to maintain and broaden access, indicating that a previous compromise had not been fully cleaned .
• A Deeper Root: Investigations revealed that the stolen credentials used in the June 5 attack had been sitting in active stealer logs for 48 days prior to weaponization, underscoring a long-term intrusion that predated the worm's activation .

Attribution: The Shai-Hulud Legacy and Copycat Problem

Miasma is a direct descendant of the Mini Shai-Hulud worm framework, a toolkit created by the threat group known as TeamPCP . TeamPCP’s earlier campaign, disclosed on May 12, 2026, had already compromised over 170 npm and PyPI packages, which had amassed more than 518 million cumulative downloads, targeting AI developer libraries directly .

The situation is further complicated because TeamPCP open-sourced the Mini Shai-Hulud framework . This means an unknown number of copycat actors have access to the same codebase. While the techniques and code strongly link Miasma to TeamPCP's lineage, multiple security researchers caution that a definitive attribution to the original group cannot be made, as any actor with the open-source toolkit could have orchestrated part or all of this specific wave .

Security Recommendations for Developers

The Miasma attack fundamentally redefines security boundaries. Opening a code repository is no longer a passive, safe action. Researchers have coalesced around several key recommendations:

• Revoke and Rotate Everything: Immediately rotate all GitHub Actions tokens, cloud provider credentials, npm publish tokens, and any other secrets that could have been exposed through CI/CD logs, infected repositories, or stealer logs .
• Enforce Strict MFA: Require multi-factor authentication, preferably using hardware security keys, for all contributor accounts to prevent credential-based intrusions .
• Sanitize AI Tooling Trust Boundaries: Treat untrusted repositories as you would an unknown binary. Configure AI coding agents (Claude Code, Cursor, Gemini CLI, VS Code) to not auto-execute or auto-read configuration files and tasks from repositories .
• Harden CI/CD Pipelines: Audit GitHub Actions workflows to restrict write access on Actions tokens, remove unused tokens, and enforce the use of short-lived credentials .
• Strengthen Supply Chain Hygiene: Use dependency scanning tools, generate an SBOM, and verify package provenance before installation. Monitor packages for obfuscated preinstall or postinstall scripts .