73 cryptographically signed npm packages from Microsoft were compromised last week with advanced credential-stealing malware that fires the moment a developer opens one in an AI coding agent. Claude Code, Gemini CLI, Cursor, VS Code — all trigger it. It's the second supply-chain attack in two months against the same Microsoft account.

"The genius of this Miasma worm lies in how it adhered to legitimate workflows. It does not exploit any software vulnerability in GitHub or npm. Instead, it exploits the underlying trust model of the modern engineering ecosystem."
— Cloudsmith

What actually changed

• 73 official Microsoft npm packages were poisoned with the Miasma worm — a clone of TeamPCP's open-sourced Mini Shai-Hulud toolkit
• Malware executes automatically when any of the 73 packages are opened inside an AI coding agent
• The payload (28 KB) harvests credentials from AWS, Azure, GCP, Kubernetes, 90+ dev tool configs, and password managers, then spreads laterally through cloud infrastructure
• Attack vector: stolen Microsoft publisher credentials → bypasses the build pipeline entirely → malicious build published with valid SLSA provenance attestation
• Each infection gets a uniquely encrypted payload — meaning hash-based IOCs are useless for detection
• GitHub initially flagged packages as "terms of service violations" rather than malware; Microsoft only acknowledged possible malicious content 48 hours later
• The same Microsoft account was compromised in May 2026 (durabletask Python SDK on PyPI, 400k downloads/month) — and apparently wasn't fully remediated

Why this one stings

The supply-chain attack playbook has levelled up. SLSA provenance — the framework designed to give you cryptographic confidence that a package came from a legitimate build — was used against you here. Attackers stole a legitimate Microsoft OIDC token, published a malicious build with real provenance, and conventional scanners waved it through as a routine trusted update.

The AI agent angle makes it worse. Previously, a developer would need to run malicious code. Now, simply opening a package in your IDE's agentic layer is enough. The attack surface for supply-chain compromise just expanded to include every AI-assisted workflow.

The fact that the same Microsoft account was hit twice is the part that should concern you most. It suggests either incomplete credential rotation after May's breach, or a second credential theft that hasn't been explained yet.

What to do

• If you used any of the 73 packages: treat your machine as compromised. Full credential rotation — cloud provider keys, password manager master, any tokens accessible from that environment. List here.
• If you use AI coding agents: audit what packages your agents have touched recently. Agentic workflows need the same supply-chain scrutiny as your CI/CD.
• Verify provenance isn't a silver bullet: SLSA levels help, but as demonstrated here, stolen publisher credentials defeat attestation. Combine provenance with behavioural analysis and sandboxed package evaluation.
• Watch for lateral movement: Miasma actively spreads to connected developer machines and CI/CD runners. Don't scope your incident response to just the machine that touched the package.

Source: Ars Technica — Dan Goodin, June 8 2026

✏️ Drafted with KewBot (AI), edited and approved by Drew.