A worm first thought to be a harmless test has in fact already armed 42 real GitHub repositories belonging to 11 owners, hijacking accounts as early as July. That is the finding of JFrog, which analysed the campaign after SafeDep first flagged it.
SafeDep spotted the variant last week, tying 18 npm packages to the same operator, published between 19 and 25 October, some carrying credential-stealing malware. Like earlier npm worms, it replicates itself, steals credentials and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token. It reuses code from June's worm and adds the token-revocation wiper from Mini Shai-Hulud.
Until 22 October SafeDep had found no compromised third-party packages or victims. JFrog's Monday report showed otherwise, finding already-armed repositories belonging to established developers and organisations. Researchers Guy Korolevski and Yair Benamou say the timing is not the only point: the payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise.
The attackers planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor and VS Code, along with polymorphic wrappers that decode a hidden CI-publisher payload. The worm steals credentials, modifies repositories and CI configurations, and spreads through npm packages.
The loader uses a compiled native add-on to decrypt and launch a second payload. Before running, it checks for CI runners, containers, sandboxes and debuggers, exiting silently if it finds them to reduce the chance of detection.
A second build skips the encrypted file and runs a loader pulled from a repository on the operator's own GitHub account, CementBeetleSteeple, which hosted 17 campaign repositories. JFrog links that account to a shellpanel scanner that Socket previously documented, used to exploit CVE-2026-41940, an authentication bypass in cPanel and WHM listed by CISA as actively exploited in April.
JFrog reports 42 armed repositories and attempted internet-wide exploitation, but has not confirmed any downstream cPanel compromises.
No comments yet. Be the first!