The Register reports a new Miasma-family npm worm, the “testmetest” campaign, quietly armed 42 real GitHub repos from 11 owners, with some account hijacks going back to July. SafeDep first spotted 18 linked packages between October 19 and 25 and thought there were no victims. JFrog found otherwise.
How it worked
The attackers planted execution hooks for AI coding tools including Claude, Gemini, Cursor and VS Code, plus 12.9 to 13.7 MB wrapper blobs, big enough to dodge GitHub’s code search. The worm steals credentials, changes repos and CI configs, and installs a wiper that deletes your home directory if you revoke the stolen GitHub token. It also skips running when it detects CI, containers or debuggers.
Checklist
- Look for unexpected agent hook or config files in your repos.
- Review recent CI workflow changes you didn’t make.
- Pin dependencies and review new npm installs.
- If you think you’re hit, isolate and back up the machine before revoking tokens, because of the wiper.
God Bless, and Needs Garlic!
