Worm armed 42 GitHub repos by hiding a payload too big to fail

A worm from the Miasma npm family compromised 42 GitHub repositories by embedding payloads between 12.9–13.7 MB — deliberately sized to exceed the indexing thresholds of GitHub's code search and automated security scanners, rendering them effectively invisible to standard tooling. Beyond persistence, the worm stole credentials, silently modified repository contents, and deployed a destructive wiper that erased the victim's home directory if their access token was revoked. This incident exposes a critical blind spot: security tooling that relies on size-based heuristics or index limits can be systematically exploited. It also illustrates how a single compromised package in the npm ecosystem can cascade laterally across multiple repositories and owners. Organizations trusting open-source registries without independent verification of package integrity are directly in this attack's blast radius.