An operator is testing a new variant of the Miasma npm worm in public. Between 19 and 22 October 2026, two npm accounts published 15 packages with names that end in testmetest . The armed versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the directory when the victim revokes the stolen GitHub token.
The worm copies Miasma “Phantom Gyp” from June 2026 and adds the token-revocation wiper from Mini Shai-Hulud. The operator changed the infrastructure, the loader and the strings, and these changes break the public detection rules for Miasma. As of 22 October 2026, SafeDep has found no compromised third-party packages or victims. All observed activity belongs to the operator’s own test accounts.
The accounts alexjoipamiba and testnewtestme published each package in three steps: a 0.0.0-stage stub, a harmless 1.0.0 decoy, then an armed patch version such as 0.0.1 that becomes latest .
Four packages are live, and [email protected] carries the worm. The other eleven left the registry on 21 October. The table lists every known version.
The operator also runs test repositories on GitHub under CementBeetleSteeple , and most already contain the worm’s files. Do not clone or open them.
The package has no install scripts. npm runs node-gyp rebuild for any package that contains binding.gyp , and the sources field runs the loader:
index.js (14.8 KB) decrypts a Bun bootstrap. The bootstrap decrypts lib_native.dat (320 KB) to /tmp/.b-*/index.js , runs it with bun run , and deletes it.
What the payload does
Evasion Exits on Russian and other Commonwealth of Independent States (CIS) locales, and on known analysis sandboxes. In GitHub Actions, kills StepSecurity Harden-Runner through docker.sock and points *.stepsecurity.io to localhost. Exits if this fails.
Exits on Russian and other Commonwealth of Independent States (CIS) locales, and on known analysis sandboxes.
In GitHub Actions, kills StepSecurity Harden-Runner through docker.sock and points *.stepsecurity.io to localhost. Exits if this fails.
Credential theft SSH keys, npm, PyPI and Git credentials, .env files, browser logins. AI tool credentials for Claude, Codex, Gemini and Copilot. AWS, GCP, Azure, Vault and Kubernetes secrets. GitHub Actions secrets from Runner.Worker process memory.
SSH keys, npm, PyPI and Git credentials, .env files, browser logins.
AI tool credentials for Claude, Codex, Gemini and Copilot.
AWS, GCP, Azure, Vault and Kubernetes secrets.
GitHub Actions secrets from Runner.Worker process memory.
Exfiltration Commits encrypted data to a new public project-utils repository on the victim’s GitHub account. The commit message starts with AutoSyncComplete: and carries the victim’s GitHub token, encrypted with a hardcoded key. Other infections for these commits to reuse the tokens. Fallback endpoint: hxxps://aiarmor[.]website/v1/api .
Commits encrypted data to a new public project-utils repository on the victim’s GitHub account.
The commit message starts with AutoSyncComplete: and carries the victim’s GitHub token, encrypted with a hardcoded key. Other infections for these commits to reuse the tokens.
Fallback endpoint: hxxps://aiarmor[.]website/v1/api .
Propagation Adds the loader to every npm package the victim maintains and publishes a new patch version. Republishes to PyPI, RubyGems and JFrog. Commits a fake CodeQL workflow and AI agent files ( .claude/settings.json , .cursor/mcp.json , CLAUDE.md , AGENTS.md , .vscode/tasks.json ) and a Windows loader .github/init.ps1 to GitHub and GitLab repositories. Each commit copies the author and message of the most recent real commit on the branch. Copies itself over SSH to the hosts in each user’s known_hosts file.
Adds the loader to every npm package the victim maintains and publishes a new patch version.
Republishes to PyPI, RubyGems and JFrog.
Commits a fake CodeQL workflow and AI agent files ( .claude/settings.json , .cursor/mcp.json , CLAUDE.md , AGENTS.md , .vscode/tasks.json ) and a Windows loader .github/init.ps1 to GitHub and GitLab repositories. Each commit copies the author and message of the most recent real commit on the branch.
Copies itself over SSH to the hosts in each user’s known_hosts file.
Persistence net-health-checker checks the stolen GitHub token every 45 seconds for 48 hours. On 401 or 403 it runs rm -rf ~/; rm -rf ~/Documents . pkg-runtime runs sync.py . Every hour it searches GitHub commits for msync-3f7a , then downloads and runs a Python script from a URL that the attacker’s RSA key signed.
net-health-checker checks the stolen GitHub token every 45 seconds for 48 hours. On 401 or 403 it runs rm -rf ~/; rm -rf ~/Documents .
pkg-runtime runs sync.py . Every hour it searches GitHub commits for msync-3f7a , then downloads and runs a Python script from a URL that the attacker’s RSA key signed.
What changed from Miasma
SafeDep infers that a copycat built this variant from the Shai-Hulud source, which its authors published in May 2026. SafeDep does not attribute it to the original Miasma operators.
A binding.gyp target whose sources contains <!(node and hides output, in a package without C or C++ sources.
A high-entropy .dat or .bin file to a small index.js with a large character-code array and eval .
A bun dependency in package.json , or a 0.0.x latest version published after 1.0.0 .
After decoding: globalThis.getBunPath , msync-3f7a , aiarmor.website , net-health-checker .
Apply the binding.gyp rule to every package. A real attack will come through compromised maintainer accounts with normal package names.
Disconnect the host from the network.
Disconnect the host from the network.
Remove persistence first. On Linux: On macOS: Then delete those two .plist files.
Remove persistence first. On Linux:
Then delete those two .plist files.
Rotate all credentials: Git hosts, package registries, cloud, Vault, Kubernetes, SSH and AI providers.
Rotate all credentials: Git hosts, package registries, cloud, Vault, Kubernetes, SSH and AI providers.
Check your accounts for new project-utils repositories, unexpected patch releases, and commits that add .claude/ , .cursor/ , .gemini/ , .vscode/tasks.json , CLAUDE.md or AGENTS.md . These files infect the host again.
Check your accounts for new project-utils repositories, unexpected patch releases, and commits that add .claude/ , .cursor/ , .gemini/ , .vscode/tasks.json , CLAUDE.md or AGENTS.md . These files infect the host again.
Reinstall the operating system on the host.
Reinstall the operating system on the host.
Indicators of compromise
See the packages for the full list of package versions.
Each build uses new keys, so payload hashes change in every version. SafeDep decoded only [email protected] , using static analysis.
The Latest from SafeDep blogs
Follow for the latest updates and insights on open source security & engineering
Anyone can compute eight eMudhra intermediate CA private keys from public certificates. Browsers block the compromised intermediates, but CI runners, containers, JVMs and Go binaries can still trust...
An attacker pushed forged commits to the default branches of hugo-paper and mevn-cli. Running npm install or bun install in either repository downloads and runs a second-stage script from...
Every wheel of LiteLLM 1.107.0 on PyPI installs a credential stealer and a remote code execution backdoor. Both run each time Python starts. The code is not in the upstream GitHub source.
The MALFEX package imgdecode contains a native Windows loader. When loaded from a console, it attempts to download, decrypt, and inject shellcode into dllhost.exe.
Start free with open source tools on your machine. Scale to a unified platform for your organization.