--- title: Self-replicating Miasma worm hits 73 Microsoft GitHub... description: The Miasma self-replicating worm has compromised 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations. The... canonical: https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack | daily.dev og:description: The Miasma self-replicating worm has compromised 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations. The... og:url: https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x og:image: https://api.daily.dev/og/posts/EeZFvGg3X.png og:image:alt: Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 2 upvotes · 0 comments ## Summary The Miasma self-replicating worm has compromised 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations. The attack exploited previously stolen credentials from a May 2026 compromise of the 'durabletask' PyPI package. A 4.3 MB payload runner is wired to execute automatically when a developer clones an affected repo and opens it in AI coding tools like Claude Code, Gemini CLI, Cursor, or VS Code. Once triggered, the Bun-based worm harvests cloud credentials (AWS, Azure, GCP, Kubernetes, npm, GitHub) and autonomously spreads by committing itself to any repo the victim can write to. Miasma is a variant of the Mini Shai-Hulud worm released by threat group TeamPCP in May 2026, which has previously hit Red Hat, TanStack, Mistral AI, and UiPath packages. The attack exploits the trust model of package registries — malicious publishes appear identical to legitimate ones. The targeting of AI coding agents represents a new evolution, as these tools increasingly open unfamiliar repositories on behalf of developers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [The ‘Miasma’ worm source code briefly leaked on GitHub](https://daily.dev/posts/the-miasma-worm-source-code-briefly-leaked-on-github-dddtnd772) · BleepingComputer · 6 upvotes · 1 comments - [Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents](https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant) · StepSecurity · 2 upvotes · 1 comments - [GitHub nukes 70\+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections](https://daily.dev/posts/github-nukes-70-microsoft-repos-breaks-ci-cd-pipelines-following-suspected-worm-infections-7xwieyhc9) · The Register · 74 upvotes · 13 comments - [GitHub disables Microsoft repos pushing password-stealing malware](https://daily.dev/posts/github-disables-microsoft-repos-pushing-password-stealing-malware-oglknbpvl) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#ai-agents](https://daily.dev/tags/ai-agents), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack","url":"https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x"},"datePublished":"2026-06-06T13:04:30.314Z","dateModified":"2026-06-06T13:04:50.658Z","description":"The Miasma self-replicating worm has compromised 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5359b42d537f91085a12c94942d38f6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d5359b42d537f91085a12c94942d38f6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,github,ai-agents,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack"}]} ```