# Miasma (TeamPCP): Microsoft and Red Hat Supply Chain Recompromise via AI Coding Agent Vector

- **Artifact ID:** CHQ-EX-2026-021
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-021
- **Machine-record SHA-256:** `8b7895012b1bef3dcb3664bcde2fba2dfa71820ace344a3f94fe2d08d98cf793`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-021",
  "title": "Miasma (TeamPCP): Microsoft and Red Hat Supply Chain Recompromise via AI Coding Agent Vector",
  "subtitle": "A self-propagating supply chain worm reached Red Hat and Microsoft package and repository infrastructure in June 2026. It recompromised a repository that had been the documented root of a May 2026 compromise, through access that the May remediation had not severed, and it executed through development environment and AI coding agent auto-run hooks rather than through the package lifecycle scripts that security tooling monitors.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (MAY 21 – JUNE 6, 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "EXHIBIT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2026-05-21",
    "temporal_end": "2026-06-06"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Red Hat Namespace Compromise: Between June 1 and June 3, 2026, packages published under the official @redhat-cloud-services npm namespace were compromised and replaced with malicious versions as part of the Miasma worm campaign. The compromise was reported by security researchers and confirmed through public package registry records.",
        "Red Hat Initial Access: Forensic reporting traced the namespace compromise to a developer account credential harvested by infostealer activity. Public logs associated with the harvested credential were dated mid-April 2026, six to seven weeks before the packages were altered. The credential persisted in adversarial possession across that interval before it was used.",
        "Red Hat Provenance State: The malicious packages were published with valid cryptographic provenance attestations. The attestations correctly recorded the identity that published the packages. They did not, and structurally could not, record whether the account behind that identity was under the control of the party it belonged to. The provenance verified lineage. It did not verify authorization.",
        "Microsoft Repository Wave: On June 5 and 6, 2026, the Miasma worm reached 73 repositories across four Microsoft GitHub organizations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs. Forty-nine were directly associated with Microsoft, Azure, and Azure-Samples. The affected set included the entire Durable Task family across language implementations, the Azure Functions organization, and AI sample applications.",
        "Microsoft Takedown: GitHub disabled the 73 affected repositories in an automated enforcement action that completed in approximately 105 seconds on June 5, 2026. The speed and scope of the automated response were noted in public reporting as indicative both of defensive automation functioning and of the scale required to trigger it.",
        "Durable Task Recompromise: The Azure Durable Task repository that was the center of the June takedown had been the documented root of a separate supply chain compromise in May 2026. Security researcher Paul McCarty characterized the relationship as the same wound reopening, and assessed that the party holding the relevant credentials in May had plausibly never fully lost that access. The May remediation addressed the visibly exposed credentials. The access relationship was not severed, and the same repository was compromised again approximately two to three weeks later.",
        "Execution Vector: This wave executed through a mechanism distinct from prior documented waves. Rather than relying on package preinstall and postinstall lifecycle scripts, which security tooling commonly monitors, the worm abused auto-run, hook, and rule engines in integrated development environments and AI coding assistants, including configurations associated with VS Code, Claude Code, Cursor, and Gemini CLI. A staged dropper executed on folder-open or agent initialization. Public reporting also documented a 157-byte binding.gyp file, referred to as a Phantom Gyp, that triggered execution during npm install.",
        "Provenance of Repository Changes: Malicious commits were introduced through the GitHub createCommitOnBranch mutation, which caused the changes to appear as verified, signed commits. The signature and provenance were valid. The authority behind them was compromised.",
        "Credential Harvest Scope: The worm’s stealer component was reported to harvest credentials across cloud and developer infrastructure, including AWS, Azure, GCP, Vault, Kubernetes, npm, and GitHub credentials, and to publish harvested material to attacker-created repository dead-drops.",
        "Actor and Lineage: The Miasma worm is a Mini Shai-Hulud variant associated with the TeamPCP toolkit, which was open-sourced in mid-May 2026. Attribution between TeamPCP operators and copycat operators using the open-sourced toolkit was not established at the time of disclosure."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "These events are recorded as a single exhibit because they are phases of one self-propagating campaign within one temporal window, and because together they document two structural properties that the prior waves in this lineage did not.",
        "The first property is credential persistence surviving remediation. The Durable Task repository was compromised in May, remediated, and compromised again in June through access that the remediation did not reach. The two compromises are most accurately read as one continuous access relationship with an interval in the middle, rather than as two independent incidents. The remediation rotated what was visibly exposed. It did not enumerate and sever the access the first compromise established. This is the distinction between rotation, which changes a credential, and revocation, which ends an access relationship.",
        "The second property is the migration of the execution vector. Prior waves executed through package lifecycle scripts, which are a monitored surface. This wave executed through development environment and AI coding agent auto-run hooks, which are not. The structural significance is that supply chain execution moved from a surface defenders instrument to a surface they generally do not. The dropper ran when a developer opened a folder or initialized an agent, before any lifecycle script would have been evaluated.",
        "A third element carries forward from adjacent exhibits rather than originating here. The Red Hat packages and the Microsoft repository commits both presented valid cryptographic provenance. The signature was accurate and the lineage was verifiable. The compromise occurred upstream of the integrity boundary that the verification checks. A defender validating provenance received a true answer to a question other than the one that determined safety.",
        "The “no confirmed exploitation of downstream consumers” framing present in early reporting follows the same epistemic pattern recorded in adjacent exhibits. At the time of disclosure, forensic teams had established that compromise occurred and had not yet confirmed downstream exploitation. The absence of confirmation at that stage is not evidence that downstream exploitation did not occur.",
        "The boundary between this exhibit and adjacent exhibits matters. The campaign shares actor lineage and toolkit with the TeamPCP cascade documented in CHQ-EX-2026-014 and the Mini Shai-Hulud cross-registry compromise documented in CHQ-EX-2026-017. This exhibit is recorded separately because the recompromise mechanism and the AI coding agent execution vector are not present in those exhibits. The shared lineage is recorded as continuity, not as a new actor claim."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-P-2026-016 — Position: Cryptographic Provenance Systems Validate Continuity of Authorization, Not Correctness of Authorization. (Red Hat and Microsoft provenance state.)",
        "CHQ-P-2026-013 — Position: Portable Developer Identity Cannot Contain Credential Compromise Across Registries. (Multi-registry, multi-organization propagation.)",
        "A-002 — Assumption (under pressure): Remediation closes the exposure surface it addresses. (Durable Task recompromise is direct disconfirming evidence.)",
        "CHQ-SC-2026-003 — Condition: Verification Collapse. (Valid provenance on compromised authority.)",
        "CHQ-SC-2026-006 — Condition: Exploitation Timing Precedes Defender Awareness. (Credential dwell from mid-April to June; recompromise interval.)",
        "CHQ-SM-2026-014 — Memorandum: Publication Authority Inheritance as Structural Attack Surface. (Reinforced, not amended; Campaign Cluster continuation.)"
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: May 21 – June 6, 2026. Exhibit issuance date is June 9, 2026. This Exhibit records findings as reported by named security research organizations, not as established fact.\n\nSources: OpenSourceMalware, BleepingComputer, The Hacker News, SecurityWeek, Paul McCarty / 6mile public commentary, GitHub enforcement records.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-06-09"
}
```