testmetest

testmetest is a credential-stealing, self-propagating software supply-chain worm associated with the Miasma family. It shares code with Miasma Phantom Gyp and incorporates token-revocation-triggered destructive functionality associated with Mini Shai-Hulud. Its operator has not been identified, and attribution to the original Miasma operators has not been established. The campaign targets developer workstations, source-code repositories, package-publishing accounts, and CI/CD environments. Investigations identified malicious npm packages and 42 armed GitHub repositories belonging to 11 owners, including established developers and organizations.

Execution begins through npm installation behavior, using either native-build configuration or post-install scripts that load a compiled native add-on. Loaders decrypt and launch JavaScript payloads, with native components identified for Linux and Windows. Evasion measures include encrypted payloads, polymorphic wrappers, analysis-environment checks, locale-based exclusions, and attempts to disable CI security controls.

The worm steals SSH keys, package-registry and Git credentials, browser logins, environment secrets, AI coding-tool credentials, and cloud and Kubernetes secrets. It extracts GitHub Actions secrets from runner process memory and modifies GitLab CI configurations to collect environment data and request package-registry identity tokens. Stolen information is encrypted and committed to public repositories created in victims’ GitHub accounts, with an external service providing fallback exfiltration.

Propagation includes publishing infected package versions, modifying repositories and CI workflows, planting execution hooks for AI coding assistants and development tools, and copying itself to SSH-accessible hosts. It supports propagation through npm, PyPI, RubyGems, and JFrog registries. Persistence components periodically retrieve and execute attacker-signed Python code and monitor stolen GitHub tokens. For up to 48 hours, a token-monitoring component checks token validity every 45 seconds and attempts to delete the victim’s home and Documents directories if the token becomes unauthorized or forbidden.