586/69 Wednesday, October 28, 2026
Security researchers from JFrog have reported a worm campaign from the Miasma malware family targeting the npm ecosystem. The activity was previously believed to be experimental, but more recent findings show that the malware had compromised 42 GitHub repositories belonging to 11 users since July. A notable feature of the campaign is the attackers’ deliberate use of unusually large payloads, ranging from 12.9 MB to 13.7 MB, as an evasion technique against GitHub code-search capabilities and automated security scanning tools. This allows the malware to remain concealed while targeting the software supply chain.
The campaign, tracked under the name testmetest, operates by inserting execution hooks into development tools and AI coding assistants such as Claude, Gemini, Cursor, and VS Code to decode and execute hidden payloads. The malware then steals credentials, modifies Continuous Integration (CI) configurations, and propagates through npm packages. It also checks the execution environment and can stop operating when it detects automated analysis systems. More significantly, researchers identified a destructive wiper capability that can delete data from a victim’s home directory if a stolen GitHub token is revoked. Researchers also found links to infrastructure previously associated with exploitation of the authentication bypass vulnerability CVE-2026-41940 affecting cPanel systems.
Software developers and administrators should review their GitHub repositories, third-party packages, and CI/CD configurations for suspicious or unauthorized execution hooks. Organizations should closely manage token permissions, monitor accounts for abnormal access activity, and apply the latest security updates addressing CVE-2026-41940 on cPanel systems according to vendor guidance. Security teams should also ensure that their scanning and analysis tools are capable of inspecting unusually large files, as attackers may deliberately use oversized payloads to bypass automated detection mechanisms.