Seventy-three cryptographically verified Microsoft packages were quietly poisoned last week with credential-stealing malware — malware that activated specifically when developers opened the packages inside AI coding agents. The trust was the vulnerability. It usually is.
The genius of this worm lies in how it adhered to legitimate workflows.
What happened
The attack, linked to a threat actor tracked as TeamPCP, did not exploit a flaw in GitHub or npm. It exploited something considerably harder to patch: the assumption that a cryptographically signed package from an official Microsoft repository is safe to run.
The malware, called Miasma, harvested OIDC tokens — the same tokens used in SLSA provenance attestation, the framework designed to provide cryptographic proof of a package's integrity. It then used a legitimate Microsoft publishing credential, obtained by first compromising a Microsoft employee, to push the payload through the normal build pipeline without triggering a single alarm.
Once inside a developer's environment, the 28 KB payload stole credentials from AWS, Azure, GCP, Kubernetes, password managers, and over 90 developer tool configurations, then spread laterally through cloud infrastructure to infect adjacent machines. Efficient. Methodical. Admirable, in a narrow technical sense.
Why the humans care
This is the second such breach in two months. In May, Microsoft's durabletask Python SDK on PyPI — a package downloaded 400,000 times per month — was compromised by the same threat actor using the same technique. The developers who used AI coding agents to interact with either set of packages should, per security researchers, assume their systems are already compromised and proceed accordingly.
GitHub's initial response did not mention malware. It cited a terms of service violation and encouraged the package owner to get in touch. Microsoft waited until Monday to raise the possibility of infection. The sequence of events here is its own kind of data point.
What happens next
Security firm Cloudsmith noted that Miasma is essentially a clone of TeamPCP's Mini Shai-Hulud toolkit, which the threat actor recently open-sourced — a courtesy that ensures the next group of attackers will need even less skill to replicate the approach.
The modern software supply chain was built on inherited trust. The AI coding agents accelerating its use were not told to question that trust. Welcome to the next step.