GitHub nuked more than 70 of Microsoft's own code repositories on Monday after attackers embedded a self-replicating credential stealer — dubbed the Miasma worm — across packages used by AI coding agents. The malware ran automatically the moment an AI agent opened an infected package, then spread itself to further repos, hunting for cloud secrets and API keys. Microsoft took the unusual step of pulling its own repos offline to contain the damage. It's the second such incident in a matter of weeks, which is not a coincidence — it's a pattern.

The attack is significant for a few reasons beyond the headline. First, the victim here wasn't some under-resourced organisation — it was Microsoft, one of the biggest operators of developer infrastructure on earth. If their own open-source tooling can be compromised this way, the implied risk to the broader ecosystem of teams pulling Microsoft's Azure and AI coding packages is considerable. Second, the malware specifically targeted the moment an AI agent opened a package. That's a meaningful evolution: attackers are designing payloads for the new automated, agent-driven development workflows rather than waiting for a human to run something.

Why this matters beyond the incident itself. Supply chain attacks on package repositories are not new — SolarWinds, XZ Utils, the earlier Shai-Hulud PyPI campaigns also in today's news — but the Miasma worm adds a self-replication capability that makes it categorically nastier than a poisoned package sitting passively waiting to be installed. Worms spread. The goal here was cloud secrets: API keys, tokens, and credentials that unlock cloud infrastructure, AI services, and downstream systems.

The timing is also notable. VS Code just announced a two-hour delay on extension auto-updates this week specifically to slow supply chain attacks. That's a good step, but it addresses a slightly different vector — Miasma didn't ride in via a VS Code extension; it came through the repos developers trust for Microsoft's own tools.

For Australian developers and security teams, the risk is real and direct. Azure is one of the dominant cloud platforms used across Australian enterprise and government. Teams using Microsoft's open-source AI tooling — particularly those running automated agent-based development pipelines — should audit recently installed packages and rotate any credentials that may have been exposed. The Australian Signals Directorate's Essential Eight mitigation strategies include application control and patching, but neither cleanly addresses the "worm inside a trusted package" threat model. This is an argument for software composition analysis (SCA) tooling in every CI/CD pipeline, not just periodic audits.

What to watch: Whether the Miasma worm is linked to a known threat actor (attribution is still unclear), how many organisations had cloud credentials exfiltrated before Microsoft pulled the repos, and whether GitHub introduces platform-level controls to detect self-replicating behaviour in published code. The worm is described as still shapeshifting, which suggests defenders haven't seen its final form yet.