JFrog researchers reported that a new Miasma-family npm worm secretly armed 42 actual GitHub repositories across 11 owners.
This operation hijacked accounts beginning as early as July. The worm utilized a stealthy payload designed to avoid detection by automated scanners and GitHub's internal systems.
Threat hunters at SafeDep, an open source supply chain security firm, initially observed the “testmetest” npm campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25. These packages included releases containing malware capable of stealing credentials.
The security researchers noted that, like prior npm worms, this malware is self-replicating, steals credentials, and installs a wiper that deletes the home directory if the victim revokes the stolen GitHub token. The new worm shares code with the June Miasma Phantom Gyp worm and incorporates Mini Shai-Hulud’s token-revocation wiper.
Initially, as of October 22, SafeDep stated they found no compromised third-party packages or victims, noting, “All observed activity belongs to the operator’s own test accounts.”
However, this assertion was contradicted by a Monday report from supply chain security company JFrog. Their analysis revealed the testmetest campaign operator “had already armed real repositories belonging to established developers and organizations.”
According to JFrog researchers Guy Korolevski and Yair Benamou, the payload blobs were sufficiently large to bypass the standard GitHub search and API paths used for identifying such compromises.
The attack mechanism involved planting execution hooks for AI coding assistants and development tools, such as Claude, Gemini, Cursor, and VS Code. These hooks were paired with polymorphic wrappers measuring 12.9 to 13.7 MB that decode a hidden CI-publisher payload.
The npm worm also steals credentials, modifies CI configurations, and spreads via npm packages. Furthermore, the malware employs a compiled native add-on to decrypt and launch a separate payload, while the loader checks for automated analysis signs before execution.
The researchers identified a second build variant that skips the encrypted file, instead forking, detaching, and running a hard-coded command to pull a loader from the operator's own GitHub account, CementBeetleSteeple, which hosted 17 campaign repositories.
JFrog linked CementBeetleSteeple to a shellpanel scanner, previously documented by Socket in an attack abusing GitHub Actions in compromised repositories to exploit CVE-2026-41940, an authentication bypass affecting cPanel and WHM.
These findings connect previously reported C2 infrastructure, identified by Socket, to the testmetest GitHub victim cluster via artifacts and workflows on the same hijacked owners, according to the JFrog researchers.
This development highlights the increasing sophistication of supply chain attacks targeting developer infrastructure, where large, evasive payloads are used to establish persistent footholds within legitimate code repositories.
