· javascript
JFrog analysis reveals Miasma-family npm worm armed 42 GitHub repos from 11 owners
Payload blobs, ranging from 12.9 to 13.7 MB, were large enough to bypass standard GitHub code searches, allowing a stealthy attack to take hold.
JFrog researchers revealed that a new Miasma-family npm worm secretly armed 42 actual GitHub repositories belonging to 11 different owners. This activity began as early as July, utilizing a payload designed to evade automated scanners on GitHub.
Threat hunters at SafeDep, a firm specializing in open source supply chain security, initially noticed the "testmetest" npm campaign last week. They observed 18 packages linked to the same operator between October 19 and October 25, some containing malware designed to steal credentials.
Security researchers noted that this malware, like previous npm worms, is self-replicating, capable of stealing credentials, and installs a wiper that wipes the home directory if the victim revokes the stolen GitHub token. This new worm incorporates a token-revocation wiper from Mini Shai-Hulud and shares code with the Miasma Phantom Gyp worm from June.
Initially, on October 22, SafeDep reported finding no compromised third-party packages or victims, stating, “All observed activity belongs to the operator’s own test accounts.”
However, this optimistic assessment proved inaccurate. In a Monday report, JFrog stated its analysis proved the operator "had already armed real repositories belonging to established developers and organizations."
According to JFrog researchers Guy Korolevski and Yair Benamou, the attack mechanism involved planting execution hooks for tools such as Claude, Gemini, Cursor, and VS Code, alongside the large polymorphic wrappers.
The worm operates by stealing credentials, modifying CI configurations, and spreading via npm packages, using a compiled native add-on to launch a separate payload after checking for signs of automated analysis.
The researchers also discovered a secondary build that bypasses the encrypted file, instead forking and running a command to pull a loader from the operator's GitHub account, CementBeetleSteeple, which hosted 17 campaign repositories.
JFrog linked this account to a shellpanel scanner, connecting the activity to a large-scale campaign previously documented by Socket that exploited CVE-2026-41940, an authentication bypass affecting cPanel and WHM.
