Miasma npm worm arms 42 GitHub repos with stealthy AI hooks and cPanel exploit infrastructure

1. Executive summary

A Miasma-family npm worm, tracked by SafeDep as the "testmetest" campaign and initially assessed as operator testing with no victims, has armed 42 GitHub repositories belonging to 11 owners, with account hijacking dating to July, according to JFrog. The worm plants execution hooks for AI coding assistants (Claude, Gemini, Cursor, VS Code), ships polymorphic wrappers of 12.9 to 13.7 MB sized to evade GitHub search and API discovery, and uses a compiled native add-on to decrypt and launch a separate payload. JFrog links the operator account CementBeetleSteeple to a shellpanel scanner that abuses GitHub Actions to exploit CVE-2026-41940, an authentication bypass in cPanel and WHM rated CVSS 9.3 critical, in CISA KEV since 2026-04-30, with EPSS at 99%. No downstream cPanel compromise has been confirmed, but any EMEA financial institution running cPanel or WHM on internet-facing infrastructure, or whose developers use the affected AI coding tools against third-party repositories, should treat this as an active exploitation risk rather than a supply chain curiosity.

2. Regulatory framing

3. Technical analysis & attack chain

The confirmed sequence, from JFrog's analysis and the earlier Miasma reporting:

1. An operator account, CementBeetleSteeple, hosts 17 campaign repositories. The operator hijacked developer and organisation accounts from as early as July and used them to push commits into 42 repositories across 11 owners.
2. Commits plant execution hooks for AI coding assistants and development tools: Claude, Gemini, Cursor, and VS Code. Opening an armed repository in one of these tools triggers the hook, the same mechanism seen in the June Microsoft incident where a malicious commit dropped configuration files that executed on IDE or AI tool open.
3. The hook loads polymorphic wrappers of 12.9 to 13.7 MB that decode a hidden CI-publisher payload. JFrog states the blobs were sized to evade the GitHub search and API paths normally used to find this kind of compromise.
4. A compiled native add-on decrypts and launches a separate payload. Before executing, the loader checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis, and exits silently when it detects them.
5. A second build skips the encrypted file entirely: it forks, detaches, and runs a hard-coded command that pulls a loader from a repository on the operator's own GitHub account.
6. Separately, the worm steals credentials, modifies repositories and CI configurations, and spreads through npm packages. It shares code with June's Miasma Phantom Gyp worm and adds the token-revocation wiper from Mini Shai-Hulud: revoking the stolen GitHub token triggers deletion of the victim's home directory.

The cPanel link. JFrog connected CementBeetleSteeple to a shellpanel scanner documented by Socket in a campaign that abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 and steal server credentials. CVE-2026-41940 is an authentication bypass in cPanel and WHM, classified CWE-306 (missing authentication for critical function), CVSS 9.3 critical, added to CISA KEV on 2026-04-30, EPSS 99%. cPanel has published patched versions. JFrog found attempted internet-wide exploitation but did not confirm any downstream cPanel compromise.

Credential targets. Earlier Miasma reporting from Microsoft and Tenable describes the payload family's harvest set: GitHub personal access tokens, npm publishing credentials, AWS, Azure and GCP credentials, Kubernetes secrets, HashiCorp Vault credentials, 1Password data, SSH keys, CLI credentials, browser and wallet data, and .env files. In CI environments the malware scrapes GitHub Actions runner memory, escalates with passwordless sudo, and republishes poisoned packages with forged SLSA provenance. Microsoft documented the process chain as node to shell to bun to payload, with the Bun runtime downloaded per platform to avoid Node-focused monitoring.

Confidence caveats. The 42-repository, 11-owner figure and the CementBeetleSteeple attribution rest on JFrog's single report; the cPanel linkage is JFrog's inference from shared artefacts and workflows on the same hijacked owners, not an observed exploitation chain. Socket's shellpanel campaign is a separate prior report. The claim that the payload blobs specifically evade GitHub search is JFrog's assessment of intent. No actor attribution to a named threat group is established: TeamPCP developed and open-sourced Mini Shai-Hulud, and Miasma is described by Snyk as its descendant, but no MITRE ATT&CK profile ties this campaign to a tracked group, so attribution remains unconfirmed.

4. Mitigation & containment

P1 within 24 hours

• Inventory internet-facing cPanel and WHM instances and confirm they run a patched version. CVE-2026-41940 is in CISA KEV with EPSS at 99%; unpatched management planes should be treated as compromised until logs show otherwise. Where patching cannot be completed immediately, restrict access to WHM and cPanel ports to known administrative source addresses.
• Search GitHub organisations for repositories touched by unfamiliar contributors since July, and for commits adding configuration files for Claude, Gemini, Cursor, or VS Code. Disable the affected repositories rather than cleaning in place.
• Do not revoke stolen GitHub tokens in isolation. The worm's wiper deletes the home directory on revocation. Snapshot developer workstations and CI runner volumes before rotating credentials, and rotate in an order that removes the token's reach before invalidating it.
• Block outbound pulls of the Bun runtime from developer workstations and CI runners except where explicitly allowlisted, and alert on node spawning shell spawning bun.

P2 within 72 hours

• Audit dependency lockfiles, internal package mirrors, build caches, container images, and CI runners for the testmetest packages and any Miasma-family artefacts before rotating secrets. Sonatype's guidance applies: swap secrets first and the attackers steal the replacements.
• Review GitHub Actions workflows for unauthorised modification, particularly jobs that reference external actions or run shellpanel-style scanning. Restrict workflow permissions to read-only by default and require review on workflow file changes.
• Rotate GitHub PATs, npm publishing tokens, cloud credentials, Vault tokens, and SSH keys held on any host that opened an armed repository, after the snapshot step above.

P3 within 7 days

• Add detection for large (12.9 to 13.7 MB) obfuscated JavaScript files and native add-ons in repository commits and package tarballs.
• Restrict AI coding assistant and IDE auto-execution of repository-supplied configuration to trusted repositories, and require explicit approval for workspace trust prompts.
• Extend third-party risk review under DORA Art. 28 and Art. 30 to code-hosting and package-registry suppliers, covering notification duties and credential-rotation responsibilities.

5. Indicators of compromise

The three commit-search strings and the campaign marker are from earlier Miasma variants documented in June; they are not confirmed present in the October testmetest build. Treat them as family-level indicators, single-sourced to SafeDep and Microsoft respectively, and verify before enforcement. No file hashes, domains, or IP addresses are available in the source material.

github_account  CementBeetleSteeple
package_name  testmetest
string  DontRevokeOrItGoesBoom
string  TheBeautifulSandsOfTime
string  firedalazer
string  Miasma: The Spreading Blight

Behavioural indicators

6. Detection

rule Miasma_Testmetest_AI_Hook_Config
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-26"
        reference = "https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570"
        description = "Detects Miasma-family campaign marker and commit-search strings in repository or package artefacts"
    strings:
        $marker = "Miasma: The Spreading Blight" ascii wide
        $c2a = "DontRevokeOrItGoesBoom" ascii wide
        $c2b = "TheBeautifulSandsOfTime" ascii wide
        $c2c = "firedalazer" ascii wide
    condition:
        uint32be(0) < 0x20000000 and
        filesize < 20MB and
        any of them
}

title: Miasma-Family Loader Process Chain and Analysis Evasion
id: 8f3c2a71-4d6e-4b9a-9c1e-7a2f5d0b3e64
status: experimental
description: Detects the node to shell to bun process chain used by Miasma-family payloads and silent exit on analysis-environment detection
author: Adverse Trace
date: 2026-10-26
references:

  - https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
  - https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/node'
  selection_shell:
    Image|endswith:

      - '/sh'
      - '/bash'
  selection_bun:
    Image|endswith: '/bun'
  condition: selection_parent and selection_shell and selection_bun
falsepositives:

  - Legitimate build tooling that invokes Bun through a shell wrapper
level: high

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• The Register, "Worm armed 42 GitHub repos by hiding a payload too big to fail", https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570, 2026-10-26
• The Register, "GitHub nukes 70+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections", https://www.theregister.com/security/2026/06/08/github-nukes-70-microsoft-repos-amid-suspected-worm-attack/5252169, 2026-06-08
• The Register, "Miasma campaign poisons 20-plus npm packages, hunts for developer secrets", https://www.theregister.com/security/2026/06/26/miasma-campaign-poisons-20-plus-npm-packages-hunts-for-developer-secrets/5262886, 2026-06-26
• The Register, "Miasma worms its way onto GitHub as attack kit goes open source", https://www.theregister.com/cyber-crime/2026/06/09/miasma-supply-chain-attack-toolkit-goes-public-on-github/5253074, 2026-06-09
• Microsoft Threat Intelligence, "Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign", https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/, 2026-06-02
• Tenable Research, "What the Miasma campaign reveals about the new supply chain threat model and the underground market for developer credentials", https://www.tenable.com/blog/what-the-miasma-campaign-reveals-about-the-new-supply-chain-threat-model-and-the-underground
• The Hacker News, "Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack", https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html

8. Adverse Trace position

Adverse Trace assesses CVE-2026-41940 at CVSS 9.3 critical, in CISA KEV since 2026-04-30, EPSS 99%, and treats any unpatched internet-facing cPanel or WHM instance as exposed to active exploitation regardless of whether the testmetest campaign reached it. The worm's reach into developer tooling and CI pipelines is the higher-likelihood exposure for most EMEA financial services clients: the 42-repository figure and the CementBeetleSteeple attribution are single-sourced to JFrog and should be verified against your own GitHub audit logs before enforcement, and the cPanel linkage is an inference from shared artefacts rather than an observed compromise. We will monitor for further JFrog or Socket reporting that confirms downstream cPanel compromise or publishes atomic indicators, and we will update this advisory if hashes or network indicators become available. Clients should prioritise the P1 cPanel patch verification and the pre-revocation snapshot step, because the wiper turns a routine credential rotation into data loss.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.