A Miasma-family npm worm secretly armed 42 real GitHub repositories belonging to 11 owners, hiding payloads too large for GitHub's code search to find, according to a report from JFrog Security Research. The campaign, dubbed testmetest, was first spotted by threat hunters at SafeDep, who identified 18 packages linked to the same operator between 19 and 25 October, including releases containing credential-stealing malware. As of 22 October SafeDep had found no compromised third-party packages or victims, concluding that all observed activity belonged to the operator's own test accounts, but JFrog's analysis showed the operator had already armed repositories belonging to established developers and organisations, hijacking accounts as early as July.

Thought to be a test, it was already real

The evasion technique was size: payload blobs measuring 12.9 to 13.7 MB were large enough to evade the GitHub search and API paths normally used to find this kind of compromise, and walking each repository through the Git trees and blobs APIs instead turned up the real count, with every reachable victim repository armed. The attackers planted execution hooks for AI coding assistants and development tools, including a Claude Code SessionStart entry running node .github/init.js when a session starts, with equivalent triggers for Gemini, Cursor MCP configuration and VS Code folder-open tasks. Ten different-looking wrappers all held the same 4,067,677-character loader and decrypted to the same 2 MB payload.

How the worm hides and what it steals

The malware is self-replicating, steals credentials, and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token, which is why JFrog advises removing its persistence before revoking anything. Stolen material includes AI tool credentials for Claude, Codex, Gemini and Copilot, plus SSH keys, registry tokens, .env files and browser logins, and npm install with ignore-scripts does not stop it. One victim account dates to 2013 and belongs to an Argentine PHP and Laravel developer, whose repositories were renamed en masse on 28 September with a come-to-telegram prefix and armed 13 at a time in a two-minute batch, with forged commits copying old messages and author dates and appending skip-checks:true so continuous integration would not run on them.

Sources: The Register and CSO Online.