Worm armed 42 GitHub repos by hiding a payload too big to fail

A new Miasma-family npm worm, initially thought to be a harmless test, secretly infected 42 GitHub repositories belonging to real developers and organizations. This malicious campaign, dubbed testmetest, was first identified by SafeDep, an open-source supply chain security firm, who discovered 18 packages tied to the same operator between October 19 and October 25.

The malware is self-replicating, steals credentials, and installs a wiper that deletes the victim's home directory when the stolen GitHub token is revoked. The worm shares code with a previous Miasma Phantom Gyp worm and adds Mini Shai-Hulud's token-revocation wiper. Despite SafeDep not finding any compromised third-party packages or victims as of October 22, JFrog researchers later revealed that the operator had indeed armed real repositories.

The payload used by the attackers was too large to be detected by GitHub's search and API paths, making it nearly invisible to automated scanners. The malware injects execution hooks for AI coding assistants and development tools, modifies repositories and CI configurations, and spreads through npm packages. It also uses a compiled native add-on to decrypt and launch a separate payload.

The operator's base was a GitHub account called CementBeetleSteeple, which hosted 17 campaign repositories. This supply chain security incident is linked to a previous CVE-2026-41940, an authentication bypass affecting cPanel and WHM, which was added to the Known Exploited Vulnerabilities catalog by CISA in April.