June 6, 2026 Update: Researchers have since linked the campaign to compromises affecting dozens of Microsoft GitHub repositories across Azure, Microsoft, MicrosoftDocs, and Azure-Samples organizations. GitHub reportedly disabled access to multiple repositories following the incident. Security researchers believe the activity may be connected to the same broader Miasma supply chain campaign and potentially related to earlier compromises involving the Durable Task ecosystem.
A new supply-chain attack has compromised 57 npm packages across more than 286 malicious versions, deploying an updated variant of the self-replicating Miasma worm designed to steal developer credentials, cloud secrets, and CI/CD tokens while targeting popular AI coding environments.
The campaign reportedly unfolded in less than 2 hours and abused the npm ecosystem to distribute malware capable of harvesting GitHub credentials, cloud access keys, SSH keys, Vault tokens, password manager data, and other sensitive developer assets.
The operation also introduced a new technique known as Phantom Gyp, which allegedly allows malicious code execution during package installation while avoiding many traditional npm security checks.
Malicious packages spread rapidly
According to publicly disclosed research, attackers published dozens of compromised packages containing the latest Miasma payload. Once installed, the malware attempted to establish persistence, collect credentials, and communicate with attacker-controlled infrastructure.
The campaign reportedly affected 57 packages and more than 286 malicious package versions before the activity was identified and disrupted.
Miasma differs from many traditional npm threats because it is designed to propagate itself. The malware allegedly modifies additional packages and repositories, allowing infections to spread further through software development workflows.
Developer infrastructure became the primary target
The malware focused heavily on developer environments rather than end users. Researchers reported that the payload searched for GitHub tokens, npm authentication credentials, SSH keys, cloud provider secrets, Vault tokens, CI/CD credentials, and other assets commonly used to access production systems.
If successful, theft of these credentials could potentially provide attackers with access to source code repositories, build pipelines, cloud environments, internal applications, and software release processes.
The campaign also reportedly leveraged GitHub repositories as part of its infrastructure, allowing stolen information and malware components to blend into legitimate developer activity.
AI coding tools added to the target list
One of the more unusual aspects of the campaign involved attempts to interact with AI-assisted development environments.
The malware reportedly targeted configuration directories associated with Claude, Cursor, Gemini, and Visual Studio Code. Researchers believe this functionality may have been intended to establish persistence, manipulate development environments, or potentially influence AI-assisted coding workflows.
The emergence of malware specifically targeting AI developer tools reflects a growing shift in attacker focus as organizations increasingly integrate generative AI platforms into software development processes.
Campaign follows broader supply-chain trend
The incident is the latest example of software supply-chain attacks targeting developer ecosystems, where a single compromised package can potentially impact thousands of downstream projects.
Recent campaigns have increasingly focused on stealing credentials and source code rather than deploying traditional malware, allowing threat actors to pivot into cloud environments and enterprise infrastructure.
BreachNews recently reported on the Mini Shai-Hulud supply-chain attack that impacted OpenAI, as well as the broader implications of self-propagating software supply-chain malware.
Organizations using npm packages are advised to review dependency inventories, rotate potentially exposed credentials, monitor build pipelines for unusual activity, and verify that affected package versions are not present within their environments.
Microsoft repositories reportedly affected
Since publication, researchers have identified additional activity linked to the campaign affecting Microsoft-owned GitHub repositories.
According to publicly disclosed findings, GitHub disabled access to dozens of repositories across Microsoft, Azure, Azure-Samples, and MicrosoftDocs organizations after malicious code was allegedly introduced into affected projects.
Researchers noted that several repositories were connected to the Durable Task ecosystem, which was previously impacted during the TeamPCP supply chain campaign. Some analysts believe the latest compromises may indicate that credentials or access obtained during earlier incidents were never fully remediated.
The campaign has also reportedly expanded beyond npm packages, with attackers allegedly pushing malicious code directly into GitHub repositories and configuring payloads to execute through developer tools including Claude Code, Cursor, Gemini CLI, Visual Studio Code, and npm test workflows.
