Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack

Miasma worm infected 73 Microsoft GitHub repos, including Azure and MicrosoftDocs. The worm plants payloads that trigger in AI coding tools like Claude Code and Cursor. GitHub disabled the repos after finding malicious code harvesting developer credentials. The attack exploits previously compromised credentials, allowing the worm to spread autonomously across repositories. The payload detonates when a developer clones an affected repo and opens it in an AI coding agent.