/
← Voltar ao feed
high software development technology

testmetest npm packages carry Miasma-family worm with token-revocation wiper; operator testing in public

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 21:00 · coletado há 1 dia

Between 19 and 22 October 2026, an operator published 15 npm packages whose names end in testmetest, carrying a Miasma-family self-propagating worm. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the victim's home directory when the stolen GitHub token is revoked. SafeDep found shared code with Miasma "Phantom Gyp" (June 2026) and the token-revocation wiper from Mini Shai-Hulud, but has not confirmed the exact lineage and does not attribute it to the original Miasma operators. As of 22 October 2026, SafeDep found no compromised third-party packages or victims; all activity belongs to the operator's own test accounts. Four packages remain live, and the other eleven were removed on 21 October.

Detalhes técnicos

  • Delivery: each package follows three steps: a 0.0.0 stub, a harmless 1.0.0 decoy, then a malicious patch version (e.g. 0.0.1) that becomes latest. There are no install scripts. A binding.gyp makes npm run node-gyp rebuild, and its sources field executes node index.js with output hidden. index.js (14.8 KB) decrypts a Bun bootstrap and lib_native.dat (320 KB), writes the payload to /tmp/.b-*/index.js, runs it with bun run and deletes it.
  • Evasion: exits on Russian and other CIS locales and on known analysis sandboxes. In GitHub Actions it kills StepSecurity Harden-Runner through docker.sock and points *.stepsecurity.io to localhost, exiting if that fails.
  • Credential theft: SSH keys, npm, PyPI and Git credentials, .env files, browser logins, AI tool credentials (Claude, Codex, Gemini, Copilot), AWS/GCP/Azure/Vault/Kubernetes secrets, and GitHub Actions secrets from Runner.Worker process memory.
  • Exfiltration: commits encrypted data to a new public repository on the victim's GitHub account (named like smart-workers-48213, description project-utils). The commit message starts with AutoSyncComplete: and carries the encrypted GitHub token, which other infections reuse. Fallback endpoint: hxxps://aiarmor[.]website/v1/api.
  • Propagation: injects the loader into the victim's npm packages and publishes a new patch version; republishes to PyPI, RubyGems and JFrog; commits a fake CodeQL workflow, AI agent files (.claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md, .vscode/tasks.json) and a Windows loader .github/init.ps1 to GitHub and GitLab repositories, copying the author and message of the latest real commit; copies itself over SSH to hosts in known_hosts.
  • Persistence and wiper: net-health-checker checks the stolen token every 45 seconds for 48 hours and runs rm -rf ~/; rm -rf ~/Documents on 401/403. pkg-runtime runs sync.py, hourly searching GitHub commits for msync-3f7a and executing a Python script from a URL signed with the attacker's RSA key.
  • Related activity: test repositories under GitHub account CementBeetleSteeple (same commit email as npm account testnewtestme); account Meteordrewarm ran the first exfiltration test on 19 September; npm removed testmgkregme on 12 October. Accounts alexjoipamiba and testnewtestme published four of the packages. Hashes change per build, and the infrastructure and strings differ from Miasma, defeating published Miasma signatures.
  • Detection: a binding.gyp target with <!(node in sources that hides output in a package with no C/C++ sources; a high-entropy .dat/.bin beside a small index.js with a large character-code array and eval; supporting signals are a bun dependency or a 0.0.x latest version published after 1.0.0.

Remediação

  • Apply the binding.gyp detection rule to all packages; a real attack would come through compromised maintainer accounts with normal package names.
  • On an infected host, disconnect from the network and remove persistence first (disable the net-health-checker and pkg-runtime systemd user services and delete their files on Linux; bootout and delete the com.user.* LaunchAgent plists on macOS).
  • Rotate all credentials: Git hosts, package registries, cloud, Vault, Kubernetes, SSH and AI providers.
  • Check accounts for new project-utils repositories, unexpected patch releases, commits adding agent files (.claude/, .cursor/, .gemini/, .vscode/tasks.json, CLAUDE.md, AGENTS.md) and commits starting with AutoSyncComplete:. The agent files can reinfect the host.
  • Reinstall the operating system on the host. Do not clone or open the CementBeetleSteeple repositories.

Linha do tempo

  1. safedep.io ↗ · pub. 21/10/2026 21:00 · coletado 22/10 15:00 primeiro registro

    testmetest npm packages carry Miasma-family worm with token-revocation wiper; operator testing in public

    ler a análise desta fonte

    Between 19 and 22 October 2026, an operator published 15 npm packages whose names end in testmetest, carrying a Miasma-family self-propagating worm. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the victim's home directory when the stolen GitHub token is revoked. SafeDep found shared code with Miasma "Phantom Gyp" (June 2026) and the token-revocation wiper from Mini Shai-Hulud, but has not confirmed the exact lineage and does not attribute it to the original Miasma operators. As of 22 October 2026, SafeDep found no compromised third-party packages or victims; all activity belongs to the operator's own test accounts. Four packages remain live, and the other eleven were removed on 21 October.

    Technical Details

    • Delivery: each package follows three steps: a 0.0.0 stub, a harmless 1.0.0 decoy, then a malicious patch version (e.g. 0.0.1) that becomes latest. There are no install scripts. A binding.gyp makes npm run node-gyp rebuild, and its sources field executes node index.js with output hidden. index.js (14.8 KB) decrypts a Bun bootstrap and lib_native.dat (320 KB), writes the payload to /tmp/.b-*/index.js, runs it with bun run and deletes it.
    • Evasion: exits on Russian and other CIS locales and on known analysis sandboxes. In GitHub Actions it kills StepSecurity Harden-Runner through docker.sock and points *.stepsecurity.io to localhost, exiting if that fails.
    • Credential theft: SSH keys, npm, PyPI and Git credentials, .env files, browser logins, AI tool credentials (Claude, Codex, Gemini, Copilot), AWS/GCP/Azure/Vault/Kubernetes secrets, and GitHub Actions secrets from Runner.Worker process memory.
    • Exfiltration: commits encrypted data to a new public repository on the victim's GitHub account (named like smart-workers-48213, description project-utils). The commit message starts with AutoSyncComplete: and carries the encrypted GitHub token, which other infections reuse. Fallback endpoint: hxxps://aiarmor[.]website/v1/api.
    • Propagation: injects the loader into the victim's npm packages and publishes a new patch version; republishes to PyPI, RubyGems and JFrog; commits a fake CodeQL workflow, AI agent files (.claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md, .vscode/tasks.json) and a Windows loader .github/init.ps1 to GitHub and GitLab repositories, copying the author and message of the latest real commit; copies itself over SSH to hosts in known_hosts.
    • Persistence and wiper: net-health-checker checks the stolen token every 45 seconds for 48 hours and runs rm -rf ~/; rm -rf ~/Documents on 401/403. pkg-runtime runs sync.py, hourly searching GitHub commits for msync-3f7a and executing a Python script from a URL signed with the attacker's RSA key.
    • Related activity: test repositories under GitHub account CementBeetleSteeple (same commit email as npm account testnewtestme); account Meteordrewarm ran the first exfiltration test on 19 September; npm removed testmgkregme on 12 October. Accounts alexjoipamiba and testnewtestme published four of the packages. Hashes change per build, and the infrastructure and strings differ from Miasma, defeating published Miasma signatures.
    • Detection: a binding.gyp target with <!(node in sources that hides output in a package with no C/C++ sources; a high-entropy .dat/.bin beside a small index.js with a large character-code array and eval; supporting signals are a bun dependency or a 0.0.x latest version published after 1.0.0.

    Remediation

    • Apply the binding.gyp detection rule to all packages; a real attack would come through compromised maintainer accounts with normal package names.
    • On an infected host, disconnect from the network and remove persistence first (disable the net-health-checker and pkg-runtime systemd user services and delete their files on Linux; bootout and delete the com.user.* LaunchAgent plists on macOS).
    • Rotate all credentials: Git hosts, package registries, cloud, Vault, Kubernetes, SSH and AI providers.
    • Check accounts for new project-utils repositories, unexpected patch releases, commits adding agent files (.claude/, .cursor/, .gemini/, .vscode/tasks.json, CLAUDE.md, AGENTS.md) and commits starting with AutoSyncComplete:. The agent files can reinfect the host.
    • Reinstall the operating system on the host. Do not clone or open the CementBeetleSteeple repositories.