EVERYTHING
According to Rescana, the Miasma worm represents an advanced evolution of supply chain malware, exploiting the inherent trust within open-source development environments. The attack began when the threat actor used previously compromised contributor credentials to push a malicious commit (hash: 5f456b8) into the Azure/durabletask repository. This commit was strategically backdated to 2020 and included a [skip ci] flag, allowing it to bypass automated Continuous Integration/Continuous Deployment (CI/CD) detection systems.
Exploiting AI Development Tool Trust
The worm did not modify any source code; instead, five configuration files were added. These files were engineered to trigger the automatic execution of a large, obfuscated JavaScript payload, measuring between 4.3 and 4.6 MB, when the repository was opened in various developer tools. The malicious code resided within .github/setup.js.
The attack specifically targeted configuration file formats used by popular AI coding agents and IDEs, including:
.claude/settings.jsonfor Claude Code.gemini/settings.jsonfor Gemini CLI.cursor/rules/setup.mdcfor Cursor.vscode/tasks.jsonfor VS Code
Upon execution, the worm functioned as a highly effective credential harvester. It successfully gathered sensitive access information for numerous cloud platforms and developer tools, enabling autonomous propagation across victim environments.
Operational Impact and Propagation
The compromised credentials allowed Miasma to commit itself into any repository accessible by the victim, facilitating rapid self-replication. The harvested data included authentication tokens for:
- AWS
- Azure
- GCP
- Kubernetes
- npm
- GitHub
The immediate operational impact was severe. Organizations relying on official GitHub Actions, such as Azure/functions-action, experienced widespread breakage in their CI/CD pipelines, rendering critical infrastructure and documentation repositories inaccessible. Though GitHub contained the threat within 105 seconds through automated enforcement, the full scope of downstream damage remains undetermined.
This technique marks a significant shift from traditional package installation attacks. Experts note that because Miasma acted as a legitimate maintainer using valid credentials, its activity was indistinguishable from routine updates on the platform. Furthermore, technical analysis links the Miasma worm to the Mini Shai-Hulud worm, previously released by the threat group TeamPCP in May 2026. The incident underscores that modern defenses must account for attacks triggered simply by interacting with a repository via an AI tool or IDE.