Miasma-family npm worm tested in public: 19 packages, credential theft, wiper on token revocation, load-time addon trigger

Linha do tempo

1. safedep.io ↗ · pub. 21/10/2026 21:00 · coletado 02/11 05:00 primeiro registro

   Miasma-family npm worm tested in public: 19 packages, credential theft, wiper on token revocation, load-time addon trigger

   ler a análise desta fonte ocultar

   An operator is publicly testing a Miasma-family npm worm. Between 19 and 27 October 2026, npm received 19 packages from the same operator, with eight published by the accounts alexjoipamiba, testnewtestme, iobandamwer and testsecuiitytestme. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that runs rm -rf ~/ when the victim revokes the stolen GitHub token. SafeDep found no compromised third-party packages or victims as of 22 October, and all observed activity belongs to the operator's own test accounts. The worm shares code with Miasma "Phantom Gyp" and adds the token-revocation wiper from Mini Shai-Hulud, but SafeDep has not confirmed its exact lineage.

   Technical Details

   • Triggers: (1) binding.gyp with a sources field that runs node index.js (alexjoipamiba, testnewtestme); (2) a postinstall script that loads a native addon (addon.node or addon_win.node) and calls init() (iobandamwer); (3) from 27 October, the addon starts the worm from napi_register_module_v1 when the package is imported, so --ignore-scripts does not protect (testsecuiitytestme). Versions 1.0.2 and 1.0.3 also use postinstall: node-gyp-build.
   • Loader: the addon decodes .napi_cache with a single-byte XOR key 0x96, and the loader runs the payload with Bun. The testsecuiitytestme builds use a new loader with a 32-byte XOR key and Brotli.
   • Evasion: exits on Russian and CIS locales and in known sandboxes. In GitHub Actions it kills StepSecurity Harden-Runner via docker.sock and redirects *.stepsecurity.io to localhost.
   • Credential theft: SSH keys, npm, PyPI and Git credentials, .env files, browser logins, AI tool credentials (Claude, Codex, Gemini, Copilot), AWS/GCP/Azure/Vault/Kubernetes secrets, and GitHub Actions secrets from Runner.Worker memory.
   • Exfiltration: encrypted commits to a new public repo on the victim's account (for example smart-workers-48213, description project-utils), with commit messages starting AutoSyncComplete:. Fallback endpoint is hxxps://aiarmor[.]website/v1/api. It also injects a GitLab CI job named cache_sync that requests npm and PyPI OIDC tokens.
   • Propagation: republishes patched npm packages, PyPI, RubyGems and JFrog packages. It commits a fake CodeQL workflow and AI agent files (.claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md, .vscode/tasks.json) plus .github/init.js and init.ps1. It spreads over SSH to hosts in known_hosts.
   • Persistence and wiper: net-health-checker polls the stolen token every 45 seconds for 48 hours and runs rm -rf ~/; rm -rf ~/Documents on a 401 or 403. pkg-runtime runs sync.py hourly, searches commits for msync-3f7a, and runs RSA-signed Python scripts.
   • Infrastructure links: the GitHub account CementBeetleSteeple shares an email with the npm account testnewtestme, and the related account Meteordrewarm ran the first exfiltration test on 19 September. npm removed earlier packages (including testmgkregme) and replaced some with 0.0.1-security placeholders.

   Remediation

   • Disconnect the host from the network, remove persistence first (systemd units and scripts on Linux, LaunchAgents on macOS), and reinstall the operating system.
   • Rotate all credentials: Git hosts, package registries, cloud, Vault, Kubernetes, SSH and AI providers.
   • Check accounts for project-utils repositories, unexpected patch releases, agent-file commits and AutoSyncComplete: commits. Check npm packages for unexpected addon.node, addon_win.node, prebuilds/*/node.napi.node or .napi_cache files.
   • Detection rules should cover all three triggers, not only binding.gyp. Do not clone CementBeetleSteeple repositories.