Worm armed 42 GitHub repos by hiding a payload too big to fail
An npm worm from the Miasma family, dubbed "testmetest," infected 42 real GitHub repositories belonging to 11 owners, with account hijacking occurring as early as July. The malware steals credentials, replicates itself, and includes a wiper payload designed to delete the home directory if victims revoke the stolen token. While SafeDep initially reported no compromised third-party packages or real victims as of October 22, JFrog's analysis later proved the operator had already compromised repositories belonging to established developers and organizations. The worm combines code from June's Miasma Phantom Gyp variant with a token-revocation wiper.
Key points
- 42 real GitHub repos compromised by self-replicating npm worm despite initial reports of only test activity
- Payload designed to evade GitHub and automated security scanners using stealthy techniques
- Malware steals credentials and includes destructive wiper triggered by token revocation
- Campaign linked to established developers; discovered by JFrog after SafeDep's initial assessment
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.
Read the full story at The Register
