Worm armed 42 GitHub repos by hiding a payload too big to fail

A new Miasma-family npm worm, initially believed to be a harmless test without any victims, has secretly infected 42 GitHub repositories from 11 owners. The stealthy payload was designed to evade detection by GitHub and automated scanners, as reported by JFrog researchers. The threat was first identified by SafeDep, an open-source supply chain security firm, which discovered 18 packages associated with the operator between October 19 and October 25.

The malware self-replicates, steals credentials, and installs a wiper that deletes the victim's home directory when they revoke the stolen GitHub token. The new worm shares code with a June Miasma Phantom Gyp worm and adds Mini Shai-Hulud's token-revocation feature. However, SafeDep found no compromised third-party packages or victims as of October 22.

JFrog's analysis revealed that the operator had already armed real repositories belonging to established developers and organizations. The attackers embedded execution hooks for AI coding assistants and development tools, like Claude, Gemini, Cursor, and VS Code, alongside polymorphic wrappers ranging from 12.9 to 13.7 MB that decode hidden CI-publisher payloads.

They also stole credentials, modified repositories and CI configurations, and spread through npm packages. To avoid detection, the malware checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis before launching a loader that pulls a second payload from the operator's own GitHub account. This account, CementBeetleSteeple, hosted 17 campaign repositories in total and is connected to a shellpanel scanner previously documented by Socket.