Researchers Said This npm Worm Had No Victims, but It Had Armed 42 GitHub Repos With Files Too Big to Search

Last week, one security firm looked at a new npm worm and found nothing but its author's own test accounts. On Monday, another showed the same operator had already planted payloads in 42 real GitHub repositories, hidden in files built to be too big for the tools defenders use to look.

The campaign, nicknamed "testmetest," was first flagged by SafeDep, an open source supply chain security firm. It tied 18 npm packages released between October 19 and October 25 to one operator, some carrying credential stealing malware. As of October 22, SafeDep said it had found no compromised third party packages or victims: "All observed activity belongs to the operator's own test accounts."

The victims nobody could see

JFrog researchers Guy Korolevski and Yair Benamou disagreed. The operator "had already armed real repositories belonging to established developers and organizations," they wrote, according to The Register. That meant 42 repositories from 11 owners, with some accounts hijacked as early as July.

The reason it stayed quiet is the uncomfortable part. "The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise," the researchers said. The polymorphic wrappers measured 12.9 to 13.7 MB and decode a hidden CI publisher payload.

Inside those repos, the attackers planted execution hooks for AI coding assistants and developer tools, including Claude, Gemini, Cursor and VS Code, CSO Online reported. Open the project in the wrong tool and the code runs.

A worm with a dead man's switch

The malware belongs to the Miasma family. It replicates itself, steals credentials, rewrites repositories and CI configurations, and spreads through npm packages. It shares code with June's Miasma Phantom Gyp worm and borrows the nastiest trick from Mini Shai-Hulud: a wiper that deletes the victim's home directory when they revoke the stolen GitHub token. Cleaning up properly is what sets it off.

One build uses a compiled native add-on to decrypt and launch its payload. Before running, it checks for CI runners, containers, sandboxes and debuggers, and exits silently if it finds any, which makes it hard to catch in analysis. A second build skips the encrypted file and pulls a loader from the operator's own GitHub account, CementBeetleSteeple, which hosted 17 campaign repositories, GBHackers noted.

A link to cPanel exploitation

JFrog connected that account to a "shellpanel" scanner that Socket had previously documented abusing GitHub Actions in compromised repos. Its target was CVE-2026-41940, a cPanel and WHM authentication bypass that CISA added to its Known Exploited Vulnerabilities catalog in April. Patched versions exist. JFrog saw attempted exploitation across the internet but did not confirm any downstream cPanel compromises.

The pattern is becoming familiar: attackers go after the tooling developers trust most, as with the poisoned LiteLLM release that stole GitHub tokens and Claude Code logs. What sets testmetest apart is that it was designed around the blind spots of the hunt itself, and for at least a week, the all clear was wrong.

Some offers on this page may be paid placements or contain affiliate links.