Miasma and Hades: Why AI Coding Agents Need an Input Firewall Before Repo Open

Miasma is a supply-chain worm class that turned repository configuration and Python startup files into execution triggers, and Hades is the PyPI wave reported alongside it.

According to coverage from The Hacker News and Dark Reading, the campaign hit 73 Microsoft GitHub repositories and traces to a compromised durabletask publish path, with naming and lineage tied to the earlier Shai-Hulud class of self-propagating supply-chain malware. The defining move is not malicious code buried in application source. It is hostile, agent-readable configuration that turns the act of opening or reading a repository — or starting a Python interpreter after install — into execution.

For an AI coding agent, that distinction matters. These files are exactly the kind of input an agent reads and trusts as project context before a human reviews anything. That is why this is an AI coding agent supply chain attack and not only a classic package-install attack.

The incident unfolded across three reported dates, each adding a new execution surface. Source status is noted on each item; where a single primary source still needs confirmation, that is called out rather than printed as settled fact.

durabletask PyPI reported
Three malicious Microsoft durabletask PyPI versions were reportedly published in a short window through a compromised publish path. Confirmed in The Hacker News and Dark Reading coverage as prior context to the June activity.

73 Microsoft repos disabled + planted config files StepSecurity primary
A malicious commit landed in Azure/durabletask using a compromised contributor account, and GitHub disabled 73 Microsoft repositories across Azure and Microsoft orgs. StepSecurity documents the planted repo-level tool configuration files — .claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, and .vscode/tasks.json — that pointed Claude Code, Gemini CLI, Cursor, and VS Code toward a .github/setup.js payload on session or folder open.

Hades PyPI wave: 37 wheels across 19 packages needs primary confirm
The Hades PyPI wave reportedly dropped 37 malicious wheels across 19 packages using Python .pth startup hooks. This detail comes from a Phoenix Security writeup that cites Socket for the underlying detection; the full 19-package list is therefore not printed here as settled fact and needs one more primary-source confirmation before publication as IOCs.

Payload behavior: Across both waves, the reported payload behavior was credential harvesting and infostealer activity: a credential and developer-secret sweep with staged exfiltration to a GitHub dead-drop. Reporting notes camouflage traffic shaped to look like normal API calls and states there is no indication that the named vendor platforms themselves were compromised — Claude Code, Gemini CLI, Cursor, and VS Code were targeted as local developer tools that read the poisoned files, not as breached services.

The attacker moved from package-install execution to agent-input execution. Classic supply-chain malware runs when you install or import a dependency. Miasma and Hades widened the trigger to two earlier, quieter moments.

Install → Open. The June 5 repo poisoning runs when an editor or AI coding agent opens the folder. A VS Code .vscode/tasks.json task with runOn: folderOpen needs no AI agent at all; the agent settings and Cursor rule files steer Claude Code, Gemini CLI, and Cursor on session start.

Open → Start. The June 7 Hades wave runs at interpreter start. A Python .pth line beginning with import is executed by Python's site machinery during startup, so code can run on the next python, pip, pytest, or notebook kernel launch after install — with no explicit import of the malicious package.

Both moves push execution before the point where a developer would normally read the code. That is the core reason an input firewall belongs in front of an AI coding agent: the agent reads repo metadata, editor config, and startup files first, and treats them as trusted context.

Sunglasses is a content-layer input filter for AI agents, not a scanner alarm: bad content goes in, clean content comes out, and the agent never reads the poisoned version because the gate blocks it before ingestion. Against this incident class, we measured our own coverage rather than guessing. The honest summary: Sunglasses catches meaningful parts of the Miasma class when hostile repo text and config are scanned before the agent reads them, and it has real, named gaps for several specific shapes.

The current live package is Sunglasses v0.2.66, with 1,046 detection patterns, 65 attack categories, and 7,631 detection keywords. The v0.2.66 release added eight discovery_file_poisoning patterns covering config and discovery files — the same broad class as agent-readable repo configuration — though not yet a dedicated hook-by-hook pattern for each surface below.

We do not claim: “Sunglasses blocks Miasma,” “detects all Hades packages,” “prevents .pth compromise,” “protects VS Code folder-open,” or “caught this before the industry did.” The honest claim is narrower and stronger: Miasma and Hades validate the threat model Sunglasses was built for, and Sunglasses is designed to filter hostile agent input before it reaches the model.

For the broader honest boundary of detection, see what Sunglasses catches and does not catch.

The right response to Miasma and Hades is not panic; it is pre-ingestion inspection. Before an untrusted repository reaches an AI coding agent or editor, treat its agent-readable surfaces as inputs to scan, not as trusted project files.

This is the workflow Sunglasses is built for: scan the repository content and agent-facing metadata an AI agent would read, in CI or locally, before that content reaches the model. We are precise about which of the surfaces above are covered today and which are on the roadmap, and we will map any public “we catch this” claim to tested results rather than aspirations.