Your GitHub Token Is Now Worth More Than Your AWS Key

The supply chain attacks that proved AI developers are the new crown jewels.

The new crown jewels aren’t in the cloud — they’re in your developer workstation.

On June 5, 2026, GitHub disabled 73 Microsoft repositories across four organizations (Azure, Azure-Samples, Microsoft, and MicrosoftDocs) in an automated sweep that lasted 105 seconds. Gone: the entire Azure Functions action, the Durable Task ecosystem, AI reference implementations. The 105-second window gets reported as a containment success. It’s an admission that Microsoft’s own AI tooling became the attack vector.

Two days later, Socket Security published its analysis of the Hades campaign: 37 malicious PyPI wheels across 19 packages, each deploying a Bun-powered credential stealer through a Python startup hook that fires before you write a single line of code. The two incidents share lineage, timing, and a target class the security coverage has not named directly: AI developers, the people who build on top of the models, are now the highest-value credential layer in the ecosystem.

The security industry spent 2024 and 2025 hardening the model. It locked down weights, audited training pipelines, red-teamed outputs. Meanwhile, the supply chain that builds with those models, the GitHub tokens, the CI/CD secrets, the Claude and Gemini API keys sitting in .config folders, was left as open water. Attackers noticed before defenders did.

The 105-Second Nuke

The Miasma worm didn’t exploit a GitHub vulnerability. It exploited a stolen developer token from a contributor whose credentials were never fully rotated after a May 19 PyPI compromise. Using that token, a malicious commit landed in Azure/durabletask, one of the core repositories in Microsoft’s cloud functions ecosystem, containing five configuration files. Each file targeted a different developer tool: Claude Code, Gemini CLI, Cursor, and VS Code. When any developer opened the repository in one of those tools, a 4.3 to 4.6 MB obfuscated JavaScript payload executed automatically, harvesting credentials before a single test ran.

The attack did not need the developer to install or click anything. It needed them to open a repository in an AI coding assistant. The tools that make developers faster, the agents that read your codebase and execute your commands, became the detonation mechanism.

GitHub’s automated systems caught it and disabled the repositories in 105 seconds. That speed is impressive. What it cannot do is tell you how many developers already had the repository open when the malicious commit landed, or how many CI/CD runners had already pulled it before the shutdown. The downstream scope remains, in the words of every security firm that analyzed this, “undetermined.”

Miasma is not an isolated incident. It is the third named variant of a campaign lineage that security researchers have been tracking since September 2025, when the original Shai-Hulud worm emerged as a self-replicating malware in the npm ecosystem. The original hit over 500 packages, prompting a CISA advisory. Shai-Hulud 2.0 in November 2025 compromised 796 npm packages across 1,092 versions, with confirmed exfiltration from over 500 GitHub users across 150 organizations, and over 20 million weekly downloads in its blast radius. Mini Shai-Hulud launched April 29 of this year, compromising 172 packages across 404 malicious versions, hitting Mistral AI, TanStack, UiPath, and SAP developer packages before the campaign source code was published publicly in mid-May. What came next followed within weeks.

The progression is deliberate. Each wave has expanded scope, refined evasion, and sharpened its targeting. The original worm went after npm tokens. Shai-Hulud 2.0 added GitHub Actions injection. Mini Shai-Hulud added .claude/settings.json as a persistence vector, targeting Claude Code users. Miasma moved from package registries to source repositories, turning IDE auto-execution into its detonation mechanism. Hades then extended into PyPI with a startup hook that bypasses install entirely.

This is directed evolution toward a specific target class: AI developer credentials and the toolchains that use them.

The Other Shoe: Hades

Two days after the Microsoft GitHub incident, Socket Security documented the Hades campaign. Where Miasma operated at the repository level, Hades went lower, into the Python package index, using a .pth startup file that executes before Python itself finishes initializing. No install hook to flag. No lifecycle script to inspect. The malicious wheel drops *-setup.pth alongside _index.js, and the Python site module runs it automatically when the interpreter starts.

The payload targets everything an AI developer touches: GitHub tokens, npm and PyPI publishing credentials, JFrog Artifactory secrets, AWS access keys, GCP service accounts, Azure credentials, Kubernetes service account material, CircleCI tokens, SSH keys, Docker configurations, shell history, .env files, and Anthropic API keys and Claude/MCP configuration files.

Socket’s technical analysis caught something the other reports missed. The Hades payload routes a portion of its exfiltration traffic through api.anthropic.com/v1/api. Anthropic's API is not a functional exfiltration channel: both GET and POST to that endpoint return Anthropic's standard 404, and the data never reaches the attacker through that path. Outbound HTTPS traffic to api.anthropic.com passes uninspected through corporate firewalls and DLP tools. Any organization running Claude has that domain on its allowlist. The attackers have catalogued which domains your security tooling trusts, and they are using that trust as camouflage.

Socket’s campaign tracker opened at 448 artifacts on June 7. Two days later it read 471: 411 npm packages across 106 namespaces and 60 PyPI artifacts across 37 packages. A second Hades wave, identified within 48 hours of the first, expanded targeting to MCP (Model Context Protocol) developers, bioinformatics researchers, and developers using OpenAI and AI coding tooling.

Why Your GitHub Token Matters More Than Your AWS Key

The standard threat model for credential theft treats cloud keys (AWS access keys, Azure service principal tokens, GCP service accounts) as the primary target. That model was accurate when cloud infrastructure was the most valuable asset a developer credential could unlock.

The AI developer workflow has changed the math.

A GitHub Personal Access Token used in an AI/ML workflow now typically grants read/write access to training data repositories, access to model weight artifacts in Git LFS or linked storage, the ability to trigger CI/CD pipelines that run fine-tuning jobs, write access to repositories that feed inference endpoints used in production, and, through those repositories, the ability to push configuration changes that affect how AI coding agents behave for every developer who opens them.

The malicious commit to Azure/durabletask did not attack Microsoft’s infrastructure. It used a GitHub token to push code that would execute inside every AI coding agent that subsequently opened the repository. The attacker used one stolen PAT to deploy credential-harvesting payloads across an unknown number of downstream developer environments. The GitHub token was the propagation mechanism.

The target list is a complete sweep of every secret that gives an AI developer elevated access to any layer of the stack: package publishing keys to push backdoored dependencies, cloud credentials to spin up compute or access model storage, CI/CD tokens to inject code into build pipelines, and AI service API keys to abuse inference endpoints or impersonate legitimate tooling. A single compromised developer workstation, opened at the wrong moment to the wrong package or repository, hands an attacker a functional capability set across all of these simultaneously.

AWS credentials still matter. But an AWS key typically gives an attacker access to infrastructure. A GitHub token used by an AI developer gives access to the code that builds the infrastructure, the models that run on it, and the developer tools that every subsequent contributor will trust.

The Security Industry’s Wrong Problem

The dominant security discourse around AI has been about the models: jailbreaking, prompt injection, training data poisoning, model weight exfiltration. These are real problems. The current wave exploits none of them.

The Shai-Hulud campaign family has exfiltrated credentials from hundreds of GitHub users across at least 150 organizations. It has compromised repositories belonging to Mistral AI, Microsoft, TanStack, Red Hat Cloud Services, and UiPath. It has targeted MCP developers, the people building the integration layer between AI models and the tools they act on. It has evolved to use AI coding tools as its detonation mechanism. It has done all of this while the security industry’s AI-focused attention was directed at the model layer.

JFrog’s analysis of the Miasma/Red Hat wave captured the problem: the malicious versions passed provenance checks because they originated from legitimate maintainer accounts, accounts the attackers controlled because they had stolen the credentials. SLSA provenance tells you a package was built in a logged environment. It does not tell you the environment’s publishing credentials were clean at build time.

The trust model that secures AI infrastructure assumes a boundary between legitimate maintainer and attacker. Shai-Hulud and its descendants have broken that assumption. They steal the identity that makes the workflow normal, and then use normal workflow tooling to propagate.

The AI coding agents that are now standard developer tooling, Claude Code, Cursor, Gemini CLI, are designed to be trusted and to act automatically on repository-level configuration. That design is correct for its intended purpose. Attackers have catalogued it and are building exploits around it. The Miasma commit worked because AI coding agents execute configuration files automatically when a repository is opened. The attack surface expanded at the moment that AI-assisted development became mainstream, and the security model for that surface has not kept pace.

What You Actually Do Now

If any member of your team opened repositories from the Azure, Azure-Samples, Microsoft, or MicrosoftDocs GitHub organizations between June 3 and June 5 using Claude Code, Gemini CLI, Cursor, or VS Code, treat their developer credentials as potentially compromised. StepSecurity’s forensic analysis of the incident is the most detailed public breakdown available.

For the Hades PyPI wave, the affected packages included names across bioinformatics, ML tooling, graph machine learning, and MCP-adjacent libraries. Socket’s blog has the full IOC list, updated as the campaign expands.

Four actions, in priority order:

Rotate GitHub Personal Access Tokens for any developer who may have been exposed. Treat it as a default assumption. The same contributor account used in the May 19 PyPI compromise was reused for the June 5 GitHub attack. Credential rotation after the first incident was incomplete; the attacker retained a working token for over two weeks.

Audit AI coding tool workspace configurations. Review which repositories have .claude/settings.json, .cursor/rules, or equivalent auto-execution configuration files, and verify each was committed by a human you trust. The Miasma payload targeted these files.

Treat GitHub PATs with CI/CD and repository write access as crown-jewel credentials. Apply the same rotation cadence, access review, and anomaly monitoring that you apply to your most sensitive cloud keys. The threat model has shifted; the controls should follow.

Review Python environments for executable .pth files and unexpected _index.js artifacts. If a package installed between June 6 and June 9 left either artifact in your environment, assume compromise and rotate all developer secrets on that machine.

The harder fix is treating the toolchain as one surface. The AI developer toolchain (package registries, GitHub, CI/CD pipelines, AI coding agents, inference API keys) is now a unified attack surface. An incident in any one component is an incident in all of them, because the credentials flow between them and the worms know it.

The attackers have been operating in the toolchain for eight months. The 105-second containment window still left the downstream scope undetermined. That is how little visibility the current security stack has into a supply chain that has been running through it.

Sources: StepSecurity forensic analysis (June 5, 2026); Socket Security Hades analysis (June 7, 2026); Rescana Miasma worm report (June 8, 2026); The Hacker News (June 8, 2026); Endor Labs bioinformatics package analysis (June 8, 2026); Socket Security Hades technical analysis (June 7, 2026); Cloud Security Alliance research note on Shai-Hulud/Megalodon (May 2026); JFrog Security Research on Miasma/Red Hat wave; Mend mini Shai-Hulud Wave analysis (May 2026); Cyber Chief incident assessment guide.