Worm Armed 42 GitHub Repos by Hiding a Payload Too Big to Fail

"Arthur T Knackerbracket" writes:

Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search:

A new Miasma-family npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July and using a stealthy payload built to stay hidden from GitHub and automated scanners, according to JFrog researchers.

Threat hunters at SafeDep, an open source supply chain security firm, first spotted the "testmetest" npm campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As with earlier npm worms, the malware is self-replicating, steals credentials, and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token, the security researchers noted.

The new npm worm shares code with June's Miasma Phantom Gypworm, and adds Mini Shai-Hulud's token-revocation wiper.

As of October 22, however, SafeDep had found no compromised third-party packages or victims. "All observed activity belongs to the operator's own test accounts," the team wrote.

As with most happy-ending security stories, that proved too good to be true.

In a Monday report, supply chain security company JFrog said itsanalysis proved otherwise, and found the testmetest campaign operator "had already armed real repositories belonging to established developers and organizations."

This isn't just about timing, either, according to JFrog researchers Guy Korolevski and Yair Benamou. "The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise," they wrote.

Read more of this story at SoylentNews.