Attackers hit 42 GitHub repos with files too large to search
Original title: Attackers compromised 42 GitHub repositories by using files too large to be searched
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
JFrog Security Research said attackers compromised 42 third-party GitHub repositories using payload blobs large enough to evade GitHub search and the contents API. Repositories held hooks for AI coding assistants and IDEs, plus polymorphic wrappers as large as 13.7MB that decoded to the same hidden payload. The related npm chain, linked to the testmetest and Miasma-family activity, stole credentials, poisoned CI, and republished malicious packages. JFrog advised treating a full-worm install as a host compromise and rotating exposed credentials.
Unconfirmed: SafeDep noted uncertainty about whether the payload belongs to the Miasma family.
- Wrappers reached 13.7MB, beyond what GitHub code search and the contents API return.
- A compiled native addon decrypts .napi_cache at runtime rather than carrying its own payload.
- Malicious npm releases ran index.js via binding.gyp and used Bun 1.2.18 after AES-128-GCM decryption.
- JFrog said to block 43.228.157.68 and remove unauthorized chore/ci-* and deps/upd-* branches.
- SafeDep first documented the npm side on October 22 and was uncertain about Miasma lineage.
Impact: Stolen developer credentials and poisoned repositories and CI publishing
- 1.Treat installation of a full-worm version as a host compromise.
- 2.Revoke and rotate GitHub, npm, cloud, SSH, and AI-provider credentials.
- 3.Enumerate repository trees directly and do not rely on GitHub code search.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552 Unsecured CredentialsT1059 Command and Scripting Interpreter
- Vendors
- GitHub
- Products
- npmGitHub Actions
- Malware
- Shai-HuludMiasmatestmetest
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 43.228.157.68 | ve fake CodeQL artifacts named scan-output . Block hxxp[:]//43[.]228[.]157[.]68:80 , and related malicious infrastructure at network |
| url | http://43.228.157.68:80 | and remove fake CodeQL artifacts named scan-output . Block hxxp[:]//43[.]228[.]157[.]68:80 , and related malicious infrastructure at network c |
From the original article
5 min read at csoonline.com
A security research firm reported Monday that it had identified breaches of 42 third-party GitHub repositories in which attackers had deployed payload blobs large enough “to evade the GitHub search and API paths normally used to find this kind of compromise.”
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.