Miasma Worm Arms GitHub Repositories with Large, Evasive Payloads
A sophisticated Miasma-family npm worm has compromised 42 GitHub repositories, employing large, obfuscated payloads and anti-analysis techniques to evade detection by security tools.
A new Miasma-family npm worm, initially dismissed as a mere test, has been discovered to have secretly compromised 42 active GitHub repositories belonging to 11 different owners. Security researchers at JFrog revealed that the campaign, which began as early as July, utilized large payloads designed to evade detection by GitHub's built-in search and API monitoring tools. This sophisticated approach allowed the malware to remain hidden while infecting legitimate development projects.
The malware, dubbed "testmetest" by threat hunters at SafeDep, exhibits self-replicating capabilities common to previous Miasma worms. It is designed to steal credentials, modify repository contents, and crucially, install a wiper component. This wiper activates upon revocation of stolen GitHub tokens, deleting the victim's home directory. The campaign also shares code with the June Miasma Phantom Gyp worm and incorporates a token-revocation wiper similar to that used by the Mini Shai-Hulud campaign.
While initial observations suggested no downstream victims or compromised third-party packages, JFrog's analysis proved otherwise. The attackers successfully infiltrated repositories belonging to established developers and organizations. The substantial size of the payload blobs, ranging from 12.9 to 13.7 MB, was a key factor in their ability to bypass standard detection mechanisms.
Technically, the attackers planted execution hooks targeting AI coding assistants and development tools such as Claude, Gemini, Cursor, and VS Code. These were combined with polymorphic wrappers that, when decoded, revealed a hidden CI-publisher payload. The worm also employs a compiled native add-on to decrypt and execute a separate, more potent payload. Before launching, the malware meticulously checks for signs of automated analysis, including CI runners, containers, sandboxes, and debuggers, exiting silently if detected to avoid triggering security alerts.
Researchers identified a secondary variant that bypassed encrypted files entirely. This version would fork, detach, and execute a hard-coded command to download a loader directly from the operator's GitHub account, named "CementBeetleSteeple." This account hosted a total of 17 campaign repositories, linking the operation to a previously documented shellpanel scanner campaign.
JFrog connected the "CementBeetleSteeple" account to a broader campaign that exploited CVE-2026-41940, an authentication bypass vulnerability affecting cPanel and WHM. This vulnerability was added to CISA's Known Exploited Vulnerabilities catalog in April. While the JFrog researchers confirmed the compromise of 42 GitHub repositories and observed attempts at internet-wide exploitation, they did not confirm any direct downstream compromises of cPanel systems as a result of this specific Miasma worm campaign.
The discovery highlights the evolving tactics of supply chain attackers, who are increasingly leveraging sophisticated evasion techniques and targeting developer tools and platforms. The use of large, multi-stage payloads and anti-analysis measures underscores the need for enhanced security monitoring and proactive threat hunting within the software development lifecycle.