Worm armed 42 GitHub repos by hiding a payload too big to fail

A Miasma-family npm worm, first thought to be only a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, according to JFrog researchers. The campaign hijacked accounts as early as July and used stealthy payloads built to stay hidden from GitHub and automated scanners. JFrog said the payload blobs measured 12.9 to 13.7 MB, large enough to evade GitHub code search.

From test to real victims

SafeDep first spotted the 'testmetest' npm campaign last week and identified 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As with earlier npm worms, the malware is self-replicating, steals credentials, and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token. As of October 22, SafeDep had found no compromised third-party packages or victims and said all observed activity belonged to the operator's own test accounts. JFrog's Monday report said its analysis proved otherwise and found the operator had already armed real repositories belonging to established developers and organizations.

How the attacks worked

The attackers planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor, and VS Code, alongside polymorphic wrappers measuring 12.9 to 13.7 MB that decode a hidden CI-publisher payload. Separately, the npm worm steals credentials, modifies repositories and CI configurations, and spreads through npm packages. The malware also uses a compiled native add-on to decrypt and launch a separate payload. Before executing, the loader checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis, exiting silently when it detects them to reduce the likelihood of detection by security scanners.

Second build and linked campaigns

Researchers also found a second build that skips the encrypted file. It forks, detaches, and runs a hard-coded command that pulls a loader from a repository on the operator's own GitHub account. That account, CementBeetleSteeple, hosted 17 campaign repositories in total. JFrog connected this account to a shellpanel scanner previously documented by Socket in a large-scale campaign that abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 and steal server credentials.

CVE-2026-41940 is an authentication bypass affecting cPanel and WHM. CISA added it to its Known Exploited Vulnerabilities catalog in April, and cPanel has since published patched versions. JFrog said the C2 infrastructure had been previously reported by Socket and that its findings connect them to the testmetest GitHub victim cluster through artifacts and workflows on the same hijacked owners. The researchers found 42 armed GitHub repositories and attempted internet-wide exploitation, but did not confirm any downstream cPanel compromises.

Sources: The Register