June 10, 2026
Background
Here's a thought to ruin your morning.
For years, the rule of thumb for not getting owned by a malicious package was basically "don't run untrusted code." Read before you execute. Be careful what you npm install. Don't pipe random shell scripts into bash like an animal. Sensible stuff. The mental model was that running the code is the dangerous part, and everything up to that point — cloning, reading, opening the folder — is safe. You're just looking.
Miasma's whole trick is that opening the folder is running the code.
Let me explain, because this is the part that rearranged my brain a little.
On June 5, GitHub disabled 73 Microsoft repositories. Not random side projects — Azure, Azure-Samples, Microsoft, MicrosoftDocs. Core infrastructure, including azure-functions-host and the entire Durable Task family. The takedown happened in a single automated sweep that lasted 105 seconds. That's not a human reviewing repos and clicking buttons; that's GitHub's abuse detection seeing something so obviously on fire that it nuked 73 of Microsoft's own repositories before anyone could finish a cup of coffee.
What set it off was a worm called Miasma, and the way it spreads is the headline.
Older supply chain malware hooked into package installation — the postinstall script, the thing that runs when you pull a dependency. Defenders know to watch those. Miasma skipped that entirely. Instead, the malicious commit dropped a couple of innocent-looking config files into the repo. Those files do nothing on their own. They wait. And then a developer clones the repo, opens it in Claude Code, or Cursor, or Gemini CLI, or VS Code — and the act of the editor/agent waking up and reading the project is what fires the payload. No install. No build. No "are you sure you want to run this." You opened a folder in the tool you open a hundred folders a day in, and it harvested your credentials.
(Yes, I appreciate the irony of describing this in a blog post that I, an AI-assisted developer, am writing with an AI assistant open in the next window. We're all in this together.)
And it's not subtle about what it takes. Once it's running it scrapes memory across Linux, macOS, and Windows, grabs cloud credentials, abuses GitHub Actions and OIDC workflows, and — here's the self-replicating bit — uses whatever access it just stole to go infect more repositories. Every compromised developer becomes a launch point for the next batch. That's why 73 repos went down at once instead of one.
Now the part that should genuinely bother you, because it's the same lesson from the last one of these I wrote about.
Not the first rodeo...
This is Microsoft's second run-in with this malware family in a matter of weeks. Back in May, the same crew hit the durabletask PyPI package in Microsoft's Azure org. And the repo at the center of this takedown? Same durabletask. Same compromised contributor account, reused. Which means one of a few things happened, none of them comforting: the credentials were never fully rotated after the first incident, or the rotation happened but the worm's own propagation loop simply re-stole fresh tokens the next time someone opened an infected repo in their editor. Either way it's the exact pattern we keep seeing — incomplete cleanup leaves a door cracked, and these people are patient enough to wait by it.
The deepest cut, though, is what this does to the idea of "verified."
Part of the campaign abused legitimate OIDC tokens, which meant the malicious releases came out the other side carrying valid SLSA provenance attestations. In plain terms: the malware shipped with a genuine, cryptographically-signed receipt saying this came from where it claims to come from. To a registry scanner, the poisoned update was indistinguishable from a routine, legitimate one. The green checkmark wasn't bypassed or forged. It was real. It just doesn't mean what we've all quietly decided it means. And to make detection even more miserable, Miasma generates a uniquely encrypted payload for every single infection — so every hash is different, and every blocklist built from "known bad" file hashes is dead on arrival.
The attackers, for what it's worth, are having a great time. The worm is an evolved fork of an earlier one called Mini Shai-Hulud, whose source the group helpfully open-sourced, and they've upgraded their branding from Dune references to Greek mythology — repo descriptions like "Miasma: The Spreading Blight" and a newer variant cheerfully named "Hades." When the people attacking the global software supply chain have a naming convention, you're not dealing with a smash-and-grab.
So where does that leave the rest of us, refreshing our editors with a new sense of dread?
Mostly it leaves us without the old shortcut. "I didn't run anything, I just opened it" is no longer a safe sentence. If you're pulling repos you don't fully trust, open them somewhere disposable — a container, a throwaway VM — before you point your editor and your live cloud credentials at them. Scope your tokens so a stolen one can't reach your whole kingdom. Watch your repos for workflow files and config that nobody on your team remembers adding. And when an upstream you depend on gets breached, treat every credential that touched it as gone, not just the ones that look obviously exposed — because the thing we keep learning, over and over, is that "we rotated the keys" and "we rotated all the keys" are very different sentences.
The supply chain used to be the thing you imported. Now it's the thing that's reading your code while you read it.
Anyway. I'm going to go open my next repo in a VM like a paranoid little goblin. Highly recommend.