Miasma npm worm armed 42 GitHub repositories, JFrog says
Original title: Worm armed 42 GitHub repos by hiding a payload too big to fail
Oversized blobs hid credential theft and a token-revocation wiper on real developer accounts, not only test repos.
JFrog says a Miasma-family npm worm that SafeDep first treated as an operator-only test had already armed 42 GitHub repositories from 11 owners, with hijacks as early as July. Payloads of 12.9 to 13.7 MB evade GitHub search, steal credentials, change repos and CI, and wipe the home directory if a stolen GitHub token is revoked. The same infrastructure is linked to earlier exploitation of CVE-2026-41940 in cPanel and WHM, but JFrog did not confirm cPanel compromises.
Unconfirmed: JFrog did not confirm downstream cPanel compromises from attempted internet-wide exploitation.
- SafeDep logged 18 testmetest packages between October 19 and October 25.
- Hooks target Claude, Gemini, Cursor, and VS Code.
- Account CementBeetleSteeple hosted 17 campaign repositories.
- A loader exits when it sees CI, containers, sandboxes, or debuggers.
- CISA added CVE-2026-41940 to the KEV catalog in April.
Impact: Stolen credentials, altered repos and CI, home-directory wipe
| Product | Affected |
|---|---|
| cPanel and WHM | — |
- CVEs
- CVE-2026-41940
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1528 Steal Application Access TokenT1485 Data DestructionT1497 Virtualization/Sandbox EvasionT1190 Exploit Public-Facing Application
- Vendors
- cPanel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
From the original article
2 min read at theregister.comPayload blobs measuring 12. 9 to 13. 7 MB were large enough to evade GitHub code search
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.