Supply chain worm quietly armed 42 real GitHub repositories, and its oversized payload helped it hide

A new npm worm from the Miasma family was originally believed to be a test with no victims. According to JFrog researchers, it had in fact secretly armed 42 real GitHub repositories belonging to 11 owners, with account hijacking dating back as early as July. SafeDep, an open source supply chain security firm, first spotted the "testmetest" campaign last week. It identified 18 packages linked to one operator, published between October 19 and October 25. As of October 22, SafeDep had found no victims.

JFrog's Monday report showed otherwise. The researchers said the operator had already armed repositories belonging to established developers and organisations. The payload files were between 12.9 and 13.7 MB, large enough to slip past the GitHub search and API paths normally used to find this kind of compromise. The attackers also planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor, and VS Code.

The worm copies itself, steals credentials, modifies repositories and CI configurations, and spreads through npm packages. It also installs a wiper that deletes the victim's home directory if the stolen GitHub token is revoked. Before running, its loader checks for signs of automated analysis, such as CI runners, containers, sandboxes, and debuggers, and exits silently if it finds them. This reduces the chance that security scanners will catch it.