Incident Published: Aug 24, 2026

Miasma Targets Repository-Local Trust in Claude Code, Gemini CLI, Cursor, and VS Code

On June 5, 2026, a previously compromised contributor account pushed commit 5f456b8 to Azure/durabletask. The commit added four repository-local trigger files and a 4.6 MB obfuscated .github/setup.js credential harvester. Opening the project could launch that payload through Claude Code or Gemini CLI SessionStart hooks, a Cursor always-applied rule, or a VS Code folder-open task. GitHub later disabled 73 repositories across four Microsoft organizations in a 105-second automated sweep; that number describes containment scope, not proof that all 73 repositories contained the malicious commit.

Supply Chain CompromiseCredential TheftConfiguration ReviewRuntime IsolationAI Coding Agent
5 applicable AIDEFEND defenses
Source: Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled 
Authors: Ashish Kurmi, StepSecurity; initial disclosure by Adnan Khan; disabled-repository list first reported by OpenSource Malware
Original article: Jun 5, 2026

Threat Analysis

  • The commit disguised configuration-only changes as a source-code update. It was backdated, carried [skip ci], and added five files while changing no application source. Repository admission that ignores editor and agent configuration leaves this path unreviewed.
  • Four distinct trigger routes converged on one payload. .claude/settings.json and .gemini/settings.json used SessionStart hooks; .cursor/rules/setup.mdc used an always-applied instruction telling Cursor to run the script; .vscode/tasks.json used runOn: folderOpen without any AI involvement.
  • The payload lived in a trusted-looking repository path. Every trigger pointed to the obfuscated .github/setup.js. Once launched, it ran with the developer process's local access and harvested credentials.
  • The reported 73 repositories must be interpreted narrowly. StepSecurity verified that GitHub disabled them in two automated waves. Its report confirms the malicious commit in Azure/durabletask, but does not prove that the payload propagated into every disabled repository.

Applicable AIDEFEND Defenses (5)

AID-H-021.001
Client-Side Configuration Enforcement
Very High
Before commit or checkout acceptance, scan repository-local Claude Code, Gemini CLI, and Cursor agent configuration. Enforce policy against SessionStart command hooks, always-applied execution instructions, backdated skip-CI commits, and unexpected executable references. The disclosed VS Code folder-open task is a separate non-AI IDE trust path and is not covered by this agent-configuration control.
AID-H-021.002
Runtime Integrity Enforcement (Signed Configurations)
Very High
For the Claude Code, Gemini CLI, and Cursor paths, reject unsigned local configuration overrides at agent startup and require approved signed configuration before a hook or rule can run. This does not claim coverage of the non-AI VS Code task path.
AID-D-004.003
Runtime Configuration & Policy Drift Detection and Monitoring
High
Monitor repository push events and alert on unverified or suspicious configuration changes, including configuration-only commits that suppress CI or introduce new automatic execution paths.
AID-I-001.002
MicroVM & Low-Level Sandboxing
High
Open untrusted projects inside a microVM or user-space-kernel boundary with additional OS sandboxing, no developer home-directory credentials, and no host write paths. This broader project-level boundary contains the agent hooks, Cursor rule, and non-AI VS Code task alike.
AID-H-025.001
Pre-Execution Static Analysis & Dangerous Construct Blocking
Partial
Immediately before execution, run a release-pinned SAST gate over the exact .github/setup.js bytes. Reject policy-defined dangerous constructs and fail closed when the 4.6 MB obfuscated artifact cannot be analyzed; static analysis alone still cannot prove a heavily obfuscated harvester safe.

What Defenders Should Do Now

  • Search clones and endpoint telemetry for commit 5f456b8 and the five paths .claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json, and .github/setup.js.
  • Quarantine repositories containing the disclosed files until their exact contents and commit provenance are reviewed.
  • Disable automatic repository-local hooks and folder-open tasks by default; require an explicit, reviewable decision before first execution.
  • Open untrusted projects in credential-free disposable workspaces, not in a developer session that carries cloud, Git, package-registry, or Kubernetes secrets.
  • If .github/setup.js may have run, investigate the endpoint and rotate accessible credentials. Do not treat a disabled repository alone as proof of payload execution.

Conclusion

Miasma moved supply-chain execution from package installation to project open. Repository-local agent configuration must be reviewed and signed before Claude Code, Gemini CLI, or Cursor starts; the separate VS Code folder-open route needs conventional IDE trust controls. At their shared payload boundary, exact-artifact static analysis and a project-level microVM or OS sandbox can keep .github/setup.js away from ambient developer credentials. The 73-repository takedown shows the operational blast radius of containment, not a verified infection count.