Miasma/Hades class of self-propagating registry worms uses AI coding-agent trigger files as an execution vector and reached Microsoft/Red Hat repos

Self-propagating registry worms (family incl. Miasma, Hades) propagate on stolen publishing identities rather than exploits. The threat-class guidance (published 2026-11-08) highlights that AI coding tool trigger files are now an execution trigger, and that trusted publishing does not close the loop because the identity behind the build can be a hijacked maintainer.

This is the exact supply-chain threat that targets AI developers: package installs, repository clones, and AI agent config/hook files are all execution points. A self-replicating worm that spreads through the dependency graph of the tools used to build and run AI systems can poison a wide community, and AI agents add new trigger surfaces.

Lifecycle/preinstall scripts, native build files, .pth files and AI coding-agent trigger files run code at install or repository-open time. The worm harvests publishing tokens/GitHost tokens/cloud keys and republishes the victim's other packages, spreading through the dependency graph.

npm/PyPI/GitHub ecosystems; execution triggers include preinstall, binding.gyp, .pth files and AI coding-agent trigger files

Rotate all developer credentials and require phishing-resistant MFA (CISA advice); disable install scripts in CI; separate release jobs from jobs that install third-party code; adopt a cooldown before adopting new versions; treat AI agent config/hook trigger files as untrusted input.