GitHub Repos Compromised by Stealthy npm Worm Payload

"All observed activity belongs to the operator’s own test accounts," SafeDep wrote — a cautionary finding that researchers at JFrog now say was incomplete. What began as a seemingly contained “testmetest” npm campaign has been reclassified: JFrog reports the operator secretly armed 42 real GitHub repositories belonging to 11 owners, and had been hijacking accounts as early as July.

JFrog findings: 42 armed repositories and account hijacks

Supply-chain security company JFrog analyzed the campaign and concluded the operator “had already armed real repositories belonging to established developers and organizations.” JFrog’s researchers, Guy Korolevski and Yair Benamou, tied the campaign to 42 armed GitHub repositories across 11 owners, and said the operator attempted internet‑wide exploitation while JFrog did not confirm any downstream cPanel compromises.

SafeDep, which first flagged the “testmetest” campaign, initially identified 18 packages linked to the same operator between October 19 and October 25; SafeDep also reported releases that contained credential‑stealing malware. As of October 22, SafeDep had found no compromised third‑party packages or victims — a finding later revised by JFrog’s broader analysis.

Miasma‑family worm behavior: credential theft, self‑replication and a wiper

JFrog and SafeDep describe a Miasma‑family npm worm that mirrors prior activity in several respects: it is self‑replicating, steals credentials, and installs a wiper that deletes the victim’s home directory when the attacker’s stolen GitHub token is revoked. The new campaign shares code with June’s Miasma Phantom Gyp worm and incorporates Mini Shai‑Hulud’s token‑revocation wiper, combining propagation and destructive elements in the same toolset.

Payload evasion and AI‑assistant hooks

Researchers found the operator used unusually large polymorphic wrappers — between 12.9 and 13.7 MB — which decode a hidden CI‑publisher payload. JFrog warned that “The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise.” The attackers also planted execution hooks aimed at AI coding assistants and developer tools, including Claude, Gemini, Cursor, and VS Code, alongside the large wrappers.

The loader contains a compiled native add‑on used to decrypt and launch a separate payload, and it performs pre‑execution checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis — exiting silently when such environments are detected. A second build variant skips the encrypted file entirely and instead "forks, detaches and runs a hard‑coded command that pulls a loader from a repository on the operator's own GitHub account," the researchers wrote.

CementBeetleSteeple, the loader repository and prior shellpanel links

JFrog traced the repository used to host the operator’s loader to a GitHub account named CementBeetleSteeple, which hosted 17 campaign repositories. JFrog connected that account to a shellpanel scanner previously documented by Socket in a large‑scale campaign that abused GitHub Actions in compromised repositories to exploit CVE‑2026‑41940 and steal server credentials.

Connection to Socket’s shellpanel scanner and CVE‑2026‑41940

JFrog noted that command‑and‑control infrastructure had been previously reported by Socket, and its findings connect those C2 systems to the testmetest GitHub victim cluster “through artifacts and workflows on the same hijacked owners.” Socket’s earlier work described abuse of GitHub Actions in compromised repositories to exploit CVE‑2026‑41940 — an authentication bypass affecting cPanel and WHM — and to harvest server credentials.

CISA added CVE‑2026‑41940 to its Known Exploited Vulnerabilities catalog in April, and cPanel has published patched versions. JFrog’s team said they observed attempted exploitation at scale but did not confirm downstream cPanel compromises stemming from this testmetest cluster.

What this means for technologists, affected enterprises, and open‑source maintainers

• Technologists and security teams: The campaign shows attackers can hide malicious CI‑publisher payloads in very large polymorphic blobs and use pre‑execution sandbox checks to avoid automated detection. Teams will need to consider repository‑side scanning limits and whether API and search paths miss oversized artifacts.
• Affected enterprises and procurement leaders: The connection between repository hijacks, abused GitHub Actions, and attempts to exploit CVE‑2026‑41940 underscores the risk from compromised developer accounts and workflows. Enterprises that run cPanel/WHM should note that CISA placed CVE‑2026‑41940 on its Known Exploited Vulnerabilities list and that cPanel has published patched versions.
• Open‑source maintainers: The operator’s ability to plant hooks for AI coding assistants and to host loaders on repositories named in the campaign highlights the need to monitor unexpected workflow changes, third‑party modifications, and new repository artifacts — including unusually large blobs that can evade standard searches.

The arc of this campaign — from a “test” initially limited to operator accounts to a covertly armed set of 42 repositories — is a reminder that findings can change as analysis widens. JFrog’s observation that payload blobs were sized to evade GitHub search and API paths is a concrete, testable claim: it leaves open whether existing repository scanning and discovery tooling will detect similarly engineered artifacts at scale, and whether any downstream compromises tied to this cluster will yet surface.

Original story