Miasma npm worm armed 42 real GitHub repos with AI-tool execution hooks and token-revocation wiper

Security researchers at JFrog have revealed that the 'testmetest' npm campaign, initially dismissed as harmless testing by SafeDep, had actually weaponized 42 real GitHub repositories belonging to established developers and organizations since July. The Miasma-family worm combines credential theft, repository modification, and a home-directory wiper triggered when victims revoke stolen GitHub tokens. Its operators planted execution hooks targeting AI coding assistants including Claude, Gemini, Cursor, and VS Code, concealed within polymorphic wrappers measuring 12.9 to 13.7 MB—large enough to slip past GitHub's standard compromise-detection interfaces.

The malware employs multiple anti-analysis techniques: a compiled native add-on decrypts and launches payloads, while the loader checks for CI runners, containers, sandboxes, and debuggers before executing. A secondary build variant forks and detaches to pull loaders directly from an operator-controlled GitHub account named CementBeetleSteeple, which hosted 17 campaign repositories. JFrog linked this infrastructure to a shellpanel scanner previously documented by Socket in a campaign exploiting CVE-2026-41940, a cPanel/WHM authentication bypass added to CISA's Known Exploited Vulnerabilities catalog in April.

Payload architecture and evasion techniques

• Oversized polymorphic wrappers: The malware hides its CI-publisher payload inside wrappers measuring 12.9 to 13.7 MB, deliberately exceeding size thresholds used by GitHub search and API paths to detect compromised repositories.
• AI assistant execution hooks: The attackers planted hooks specifically targeting Claude, Gemini, Cursor, and VS Code, integrating compromise directly into modern development workflows rather than relying solely on traditional CI/CD injection.
• Environment-aware loader: Before execution, the native add-on loader probes for CI runners, containers, sandboxes, and debuggers, exiting silently when automated analysis is detected to avoid security scanner detection.
• Token-revocation wiper: The malware incorporates Mini Shai-Hulud's wiper mechanism, which deletes the victim's home directory upon GitHub token revocation—an aggressive retaliation mechanism against incident response.
• Dual payload delivery: Beyond the encrypted native add-on path, a second build variant forks, detaches, and executes a hard-coded command to fetch a loader from the CementBeetleSteeple GitHub account, providing redundant persistence.

Why it matters

This campaign demonstrates that npm's open package ecosystem remains a critical vector for supply chain attacks targeting not just individual developers but the AI-assisted coding tools now embedded in mainstream workflows. The deliberate evasion of GitHub's native detection interfaces by payload size manipulation exposes a gap in platform-level security scanning that other attackers may replicate, particularly as AI coding assistants gain broader adoption across open-source and commercial development.