Miasma Worm AI Coding Tool Credential Theft via node/bun/python

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects unauthorized access by scripting engines (node.exe, bun.exe, python.exe) to configuration, task files, or sensitive credential stores associated with AI coding assistants and IDEs such as Cursor, Claude, Gemini, and VS Code. This pattern is consistent with the behavior of the Miasma worm, which attempts to exfiltrate developer tokens or environment configurations.