[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqSiwbn29gCKyOI-AWtNu6nKLliKKbEKUalr2qthHomY":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"78ba8244-d466-48da-8007-66b36b3eb8ff","Worm armed 42 GitHub repos by hiding a payload too big to fail","worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-7e3495","Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search","A new Miasma-family npm worm, initially thought to be a test, secretly compromised 42 GitHub repositories from 11 owners. The worm used large payload blobs (12.9-13.7 MB) to evade GitHub's code search and automated scanners. It also steals credentials, modifies repositories, and installs a wiper that deletes the home directory upon token revocation.","Miasma-family npm worm hid large payloads to evade GitHub scans, compromising 42 repositories.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F26\u002Fworm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail\u002F5305570","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5242669&width=800","2026-10-26T22:29:01+00:00","2026-10-26T23:00:07.641217+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"npm","product",{"name":21,"type":19},"GitHub",{"name":23,"type":19},"Claude",{"name":25,"type":19},"Gemini",{"name":27,"type":19},"Cursor",{"name":29,"type":19},"VS Code","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-41940","Authentication bypass affecting cPanel and WHM, used in a related campaign.",[18,21,23],{"controls":60,"vendors":144},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":52,"name":91,"problem":92,"products":93},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":119,"name":120,"problem":121,"products":122},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[123,131,138],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":132,"vendor_name":21,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[145,148],{"slug":132,"name":21,"logo_path":133,"roles":146},[147],"affected",{"slug":124,"name":125,"logo_path":126,"roles":149},[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":163},"npm-worm-hijacks-42-github-repos-using-oversized-payload-evasion","npm Worm Hijacks 42 GitHub Repos Using Oversized Payload Evasion","A worm from the Miasma npm family compromised 42 GitHub repositories by embedding payloads between 12.9–13.7 MB — deliberately sized to exceed the indexing thresholds of GitHub's code search and automated security scanners, rendering them effectively invisible to standard tooling. Beyond persistence, the worm stole credentials, silently modified repository contents, and deployed a destructive wiper that erased the victim's home directory if their access token was revoked. This incident exposes a critical blind spot: security tooling that relies on size-based heuristics or index limits can be systematically exploited. It also illustrates how a single compromised package in the npm ecosystem can cascade laterally across multiple repositories and owners. Organizations trusting open-source registries without independent verification of package integrity are directly in this attack's blast radius.",[156,157,158,159,160,161,162],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":164,"MITRE ATT&CK T1566: Phishing":165,"NIST SP 800-53 SI-2: Flaw Remediation":166,"OWASP A06:2021 Vulnerable and Outdated Components":167,"CIS Control 7: Continuous Vulnerability Management":168,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":169,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":170},"NIS2 requires incident handling and supply-chain security measures; the silent lateral compromise of 42 repositories and the destructive wiper payload represent exactly the kind of supply-chain incident NIS2 obligates covered entities to detect, contain, and report.","While delivery was via npm rather than email, the worm used a deceptive 'too large to scan' technique analogous to payload obfuscation — a supply-chain variant of adversarial delivery that ATT&CK's evasion sub-techniques (T1027) and supply chain compromise (T1195) collectively cover, highlighting the need for content-agnostic inspection.","SI-2 requires organizations to identify and remediate flaws in information systems and software components, which extends to malicious or compromised third-party packages introduced through the supply chain.","This attack exploited the implicit trust organizations place in npm packages; A06 directly calls for verifying the integrity, provenance, and security posture of every third-party component before use.","Regular scanning of dependencies and repository contents — including anomaly detection for oversized payloads — would have flagged the malicious npm packages before they propagated across 42 repositories.","A.8.8 mandates timely identification and management of technical vulnerabilities in software assets, including third-party libraries, which would require controls to detect malicious or oversized npm packages.","The worm harvested and abused repository access tokens; enforcing short-lived, scoped credentials and token rotation policies directly limits the blast radius of such credential theft."]