Summary: A hijacked contributor pushed malicious commit 5f456b8 to Microsoft’s Azure/durabletask repository on June 5, 2026, planting files that targeted Claude Code, Gemini CLI, Cursor, and VS Code. The payload waited until a folder was opened rather than executing on package install. GitHub disabled 73 repositories across four organizations within 105 seconds, breaking workflows that referenced Azure’s official functions-action.
Malicious commit 5f456b8 reached Microsoft’s Azure/durabletask GitHub repository on June 5, 2026, pushed by a hijacked contributor account. Its message announced a refactor (“Switched DataConverter to OrchestrationContext”); the diff changed no source files at all. What it carried were five planted files, aimed not at a package manager but at the AI coding agents and editors developers open daily — Claude Code, Gemini CLI, and Cursor. This was the Miasma worm striking Microsoft again, and the episode marks supply-chain attacks moving from “execute on install” to “execute on folder open.”
GitHub’s automated enforcement shut down 73 repositories across four organizations within 105 seconds, and Azure’s official deployment Action went down with them, breaking CI/CD pipelines on the spot. StepSecurity’s forensic writeup, plus follow-up reporting from The Register, piece the full picture together.
A Two-Front Campaign: Poison PyPI, Then the Repo Itself
Miasma is the supply-chain worm that followed TeamPCP (C2 domain t.m-kosche[.]com), and it had already claimed 113+ GitHub repositories across dozens of accounts, with TanStack, Mistral AI, @antv, @redhat-cloud-services, LiteLLM, Telnyx, and Checkmarx among its earlier victims. Its offensive against Microsoft ran on two fronts.
Front one opened on May 19: with a stolen publishing token, the attacker shipped three malicious versions of the durabletask PyPI package (1.4.1, 1.4.2, 1.4.3) in 35 minutes, skipping CI/CD entirely. The payload swept secrets from AWS, Azure, GCP, Kubernetes, and 90+ developer tool configurations; once Issue #137 flagged the package, Microsoft pulled it.
Front two was the June 5 injection: the same compromised contributor account pushed a commit straight to the repository, backdated to 2020 and carrying a skip ci tag to slip past automated checks. The registry was no longer the battleground — the source code was.
The Chain: Open the Folder and It Fires
Four tools, five planted files, one destination: everything converges on a single 4.6 MB (4,643,745-byte) obfuscated payload (.github/setup.js).
- .claude/settings.json — a SessionStart hook fires the payload the instant Claude Code opens the repository
- .gemini/settings.json — the same hook, wired for Gemini CLI
- .cursor/rules/setup.mdc — a prompt injection posed as setup guidance, with alwaysApply on
- .vscode/tasks.json — fires on folder open; no AI agent needed at all
- .github/setup.js — the credential-stealing payload itself
A clone on its own does no harm; the payload waits for the folder to open. StepSecurity calls this the move from “execute on package install” to “execute on folder open” — the attack surface has left the package manager for the developer’s editor. The June payload also rides inside the repository, works across platforms, and needs no C2 infrastructure.
105 Seconds, 73 Repositories — and functions-action
GitHub’s enforcement ran in two waves between 16:00:50 and 16:02:35 UTC: 39 repositories down in 38 seconds, then 34 more in 11 after a 56-second pause, every one returning HTTP 403 with reason “tos.” The count: 49 in Azure (azure-functions-host, azure-webjobs-sdk, functions-action, and azure-functions-durable-extension included), 10 in microsoft (durabletask-dotnet, -go, -js, -netherite, and more), 13 in Azure-Samples (rag-postgres-openai-python and llm-fine-tuning included), and 1 in MicrosoftDocs. StepSecurity confirmed 16 similar repositories were left alone — the sweep picked its targets.
Collateral arrived at once. Azure/functions-action is the official GitHub Action for deploying Azure Functions; with its repository gone, every workflow referencing @v1 broke, and 20+ developers reported failures on Microsoft Learn Q&A. Microsoft first called it a policy violation, then an “internal management issue” within twelve minutes, pointing to Azure CLI, Azure DevOps Pipelines, VS Code deployment, or Zip Deploy instead. The episode also resurfaced the mutable-tag problem: tags vanish with the repository, while workflows pinned to commit SHAs fail in a way you can predict.
The Kit Leaks: Miasma’s Source Is Public
From June 8, repositories named “Miasma-Open-Source-Release” surfaced on GitHub through four already-compromised developer accounts — the worm’s full source code is now public. SafeDep, which examined one before GitHub removed it, called it “a full supply chain attack toolkit that allows the operator to execute various attacks via stolen credentials,” spanning PyPI, npm, RubyGems, JFrog Artifactory, GitHub repos and Actions, AI coding tool config poisoning, and SSH-based lateral movement. Wiz traces Miasma to the Mini Shai-Hulud toolkit, and notes TeamPCP open-sourced its original worm in May while running a supply-chain attack contest on BreachForums.
The worm never leaves GitHub and needs no custom C2 infrastructure: three independent commit-search channels — DontRevokeOrItGoesBoom, TheBeautifulSandsOfTime, and firedalazer — handle exfiltration (tokens encrypted with AES-256-CBC inside commit messages), instant JavaScript execution via eval, and a persistent Python monitor. SafeDep’s conclusion for defenders: detection now has to look for behavioral anomalies at the application-protocol level, because network-level indicators no longer work. As of June 9, Socket counted 473 affected package artifacts.
What Defenders Should Do Now
StepSecurity’s guidance is concrete enough to drop into a runbook:
- Treat every system that opened an affected repo after June 2 as compromised, and rotate all credentials
- Sweep repositories for .claude/, .gemini/, .cursor/, and .vscode/tasks.json files that don’t belong
- Watch network logs for check.git-service[.]com and t.m-kosche[.]com
- Enforce PR reviews through branch protection; block direct pushes to main
- Shift PyPI publishing to Trusted Publishing (OIDC); drop long-lived tokens
- Pin GitHub Actions to commit SHAs
- Keep CI/CD runner egress restricted and monitored
For anyone procuring AI tooling the bar has moved: once agent config files count as a first-class attack surface, every file an AI agent will read must be treated as executable code in your threat model.