--- title: Worm armed 42 GitHub repos by hiding a payload too big... description: A Miasma-family npm worm, once dismissed as a harmless test, actually armed 42 real GitHub repositories from 11 owners, JFrog researchers found. The worm... canonical: https://daily.dev/posts/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-vr4glymh1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Worm armed 42 GitHub repos by hiding a payload too big to fail | daily.dev og:description: A Miasma-family npm worm, once dismissed as a harmless test, actually armed 42 real GitHub repositories from 11 owners, JFrog researchers found. The worm... og:url: https://daily.dev/posts/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-vr4glymh1 og:image: https://api.daily.dev/og/posts/Vr4GLyMh1.png og:image:alt: Worm armed 42 GitHub repos by hiding a payload too big to fail og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Worm armed 42 GitHub repos by hiding a payload too big to fail **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary A Miasma-family npm worm, once dismissed as a harmless test, actually armed 42 real GitHub repositories from 11 owners, JFrog researchers found. The worm hijacked accounts as early as July and hid payload blobs measuring 12.9 to 13.7 MB, large enough to dodge GitHub's code search and API scanning. It plants hooks for AI coding assistants like Claude, Gemini, Cursor and VS Code, steals credentials, and installs a wiper that deletes the victim's home directory if they revoke the stolen GitHub token. JFrog linked the operator's account, CementBeetleSteeple, which hosted 17 campaign repositories, to a cPanel exploitation campaign targeting CVE-2026-41940, though no downstream cPanel compromises were confirmed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the Miasma npm worm hide its payload from GitHub code search? It used polymorphic wrapper files measuring 12.9 to 13.7 MB, large enough to evade the GitHub search and API paths typically used to detect compromised code. The loader also checks for CI runners, containers, sandboxes, and debuggers before executing, exiting silently if it detects automated analysis tools to avoid security scanners. _Teams relying on GitHub scanning to catch malicious packages can track worm evasion techniques like this on daily.dev._ ### What happens if you revoke a GitHub token stolen by the Shai-Hulud or Miasma npm worm? Revoking the stolen token triggers a wiper that deletes the victim's home directory. This token-revocation wiper behavior was added to the Miasma worm from the Mini Shai-Hulud worm, making incident response itself a trigger for data destruction rather than a safe containment step. _Developers responding to npm supply chain incidents can follow worm behavior updates like this on daily.dev._ ### How many GitHub repositories did the testmetest npm worm campaign compromise? JFrog found 42 real GitHub repositories from 11 owners had been armed by the testmetest campaign operator, despite earlier analysis by SafeDep concluding the activity involved only the operator's own test accounts with no real victims. The operator's own account, CementBeetleSteeple, hosted 17 of the campaign repositories. _Maintainers auditing their own repos for supply chain compromise can follow cases like this on daily.dev._ ## Similar posts on daily.dev - [Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack](https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x) · The Next Web · 2 upvotes · 0 comments - [GitHub nukes 70\+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections](https://daily.dev/posts/github-nukes-70-microsoft-repos-breaks-ci-cd-pipelines-following-suspected-worm-infections-7xwieyhc9) · The Register · 75 upvotes · 13 comments - [GitHub disables Microsoft repos pushing password-stealing malware](https://daily.dev/posts/github-disables-microsoft-repos-pushing-password-stealing-malware-oglknbpvl) · BleepingComputer · 1 upvotes · 0 comments - [New npm worm hits CI pipelines and AI coding tools](https://daily.dev/posts/new-npm-worm-hits-ci-pipelines-and-ai-coding-tools-3fx3mdyns) · InfoWorld · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-vr4glymh1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Worm armed 42 GitHub repos by hiding a payload too big to fail","url":"https://daily.dev/posts/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-vr4glymh1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-vr4glymh1"},"datePublished":"2026-10-26T22:31:42.633Z","dateModified":"2026-10-30T07:47:30.490Z","description":"A Miasma-family npm worm, once dismissed as a harmless test, actually armed 42 real GitHub repositories from 11 owners, JFrog researchers found. The worm...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8a6c9c7d214a0b61906102cf24b52db5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8a6c9c7d214a0b61906102cf24b52db5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-vr4glymh1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,github,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Worm armed 42 GitHub repos by hiding a payload too big to fail"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-vr4glymh1#faq","mainEntity":[{"@type":"Question","name":"How did the Miasma npm worm hide its payload from GitHub code search?","acceptedAnswer":{"@type":"Answer","text":"It used polymorphic wrapper files measuring 12.9 to 13.7 MB, large enough to evade the GitHub search and API paths typically used to detect compromised code. The loader also checks for CI runners, containers, sandboxes, and debuggers before executing, exiting silently if it detects automated analysis tools to avoid security scanners. Teams relying on GitHub scanning to catch malicious packages can track worm evasion techniques like this on daily.dev."}},{"@type":"Question","name":"What happens if you revoke a GitHub token stolen by the Shai-Hulud or Miasma npm worm?","acceptedAnswer":{"@type":"Answer","text":"Revoking the stolen token triggers a wiper that deletes the victim's home directory. This token-revocation wiper behavior was added to the Miasma worm from the Mini Shai-Hulud worm, making incident response itself a trigger for data destruction rather than a safe containment step. Developers responding to npm supply chain incidents can follow worm behavior updates like this on daily.dev."}},{"@type":"Question","name":"How many GitHub repositories did the testmetest npm worm campaign compromise?","acceptedAnswer":{"@type":"Answer","text":"JFrog found 42 real GitHub repositories from 11 owners had been armed by the testmetest campaign operator, despite earlier analysis by SafeDep concluding the activity involved only the operator's own test accounts with no real victims. The operator's own account, CementBeetleSteeple, hosted 17 of the campaign repositories. Maintainers auditing their own repos for supply chain compromise can follow cases like this on daily.dev."}}]} ```