Miasma worm secretly armed 42 GitHub repositories

JFrog researchers found that the Miasma-family npm worm, previously thought to be a victimless test, hijacked accounts since July and armed 42 real GitHub repositories from 11 owners. Payload blobs of 12.9–13.7 MB evaded GitHub code search, and the malware planted hooks for Claude, Gemini, Cursor and VS Code.

• Armed 42 GitHub repos from 11 owners since July 2026
• 12.9–13.7 MB payloads evaded GitHub search and API
• Planted execution hooks for Claude, Gemini, Cursor, VS Code
• Wiper deleted victim's home directory on token revocation