Worm armed 42 GitHub repos by hiding a payload too big to fail

As cited

Copy frozen at 2026-10-26 23:49 UTC (site build).

vulnerabilities

Worm armed 42 GitHub repos by hiding a payload too big to fail

A Miasma-family npm worm dubbed testmetest secretly compromised 42 real GitHub repositories across 11 owners starting in July, using large polymorphic payloads designed to evade GitHub search and automated scanners. The malware steals credentials, hijacks accounts, modifies CI configurations, and includes anti-analysis checks to bypass detection by security tools. Researchers linked the campaign to infrastructure previously used in shellpanel scanning exploits targeting CVE-2026-41940, an authentication bypass in cPanel and WHM.

Why it matters: Open source developers and organizations using cPanel, WHM, or GitHub Actions are exposed to account hijacking and credential theft; practitioners should audit GitHub token access, review repository configurations for unauthorized CI modifications, and prioritize patching CVE-2026-41940 (CVSS 9.3) on cPanel systems.

Source published

2026-10-26 22:29 UTC

First seen by Cybersecurity Tracker

2026-10-26 22:37 UTC