[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQzLO99XF4L_asR_n0u4I-adfQm4lAXZBKfPxQ5mhAYY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"0567a5de-7e9c-404b-b735-2457f78cc497","npm-worm-hijacks-42-github-repos-using-oversized-payload-evasion","78ba8244-d466-48da-8007-66b36b3eb8ff","npm Worm Hijacks 42 GitHub Repos Using Oversized Payload Evasion","A worm from the Miasma npm family compromised 42 GitHub repositories by embedding payloads between 12.9–13.7 MB — deliberately sized to exceed the indexing thresholds of GitHub's code search and automated security scanners, rendering them effectively invisible to standard tooling. Beyond persistence, the worm stole credentials, silently modified repository contents, and deployed a destructive wiper that erased the victim's home directory if their access token was revoked. This incident exposes a critical blind spot: security tooling that relies on size-based heuristics or index limits can be systematically exploited. It also illustrates how a single compromised package in the npm ecosystem can cascade laterally across multiple repositories and owners. Organizations trusting open-source registries without independent verification of package integrity are directly in this attack's blast radius.","**Immediate actions:**\n- Audit all npm dependencies in CI\u002FCD pipelines and repositories for anomalously large or recently published packages with unexpected binary blobs.\n- Rotate all GitHub personal access tokens and repository secrets for any environment that consumed potentially affected npm packages.\n- Enable GitHub secret scanning and push protection to detect credential exfiltration attempts at the repository level.\n\n**Detection measures:**\n- Deploy a software composition analysis (SCA) tool that scans package contents at install time, including packages exceeding typical size thresholds, rather than relying solely on registry metadata.\n- Implement file-integrity monitoring and repository change alerting to detect unauthorized modifications to source files or CI\u002FCD configuration.\n- Log and alert on any process or script that attempts to delete or wipe home-directory contents on developer workstations or CI runners.\n\n**Long-term improvements:**\n- Enforce a package allowlist and lockfile integrity policy so only approved, hash-verified npm packages can be installed in pipelines.\n- Adopt a zero-trust posture for CI\u002FCD token permissions using short-lived, scoped tokens (e.g., GitHub OIDC) rather than long-lived personal access tokens.\n- Invest in supply-chain security tooling such as SLSA provenance attestation and Sigstore signing to cryptographically verify package origin and integrity.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires incident handling and supply-chain security measures; the silent lateral compromise of 42 repositories and the destructive wiper payload represent exactly the kind of supply-chain incident NIS2 obligates covered entities to detect, contain, and report.","While delivery was via npm rather than email, the worm used a deceptive 'too large to scan' technique analogous to payload obfuscation — a supply-chain variant of adversarial delivery that ATT&CK's evasion sub-techniques (T1027) and supply chain compromise (T1195) collectively cover, highlighting the need for content-agnostic inspection.","SI-2 requires organizations to identify and remediate flaws in information systems and software components, which extends to malicious or compromised third-party packages introduced through the supply chain.","This attack exploited the implicit trust organizations place in npm packages; A06 directly calls for verifying the integrity, provenance, and security posture of every third-party component before use.","Regular scanning of dependencies and repository contents — including anomaly detection for oversized payloads — would have flagged the malicious npm packages before they propagated across 42 repositories.","A.8.8 mandates timely identification and management of technical vulnerabilities in software assets, including third-party libraries, which would require controls to detect malicious or oversized npm packages.","The worm harvested and abused repository access tokens; enforcing short-lived, scoped credentials and token rotation policies directly limits the blast radius of such credential theft.","published","2026-10-26T23:20:29.595743+00:00","2026-10-26T23:20:29.58+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F26\u002Fworm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail\u002F5305570","worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail-7e3495","Worm armed 42 GitHub repos by hiding a payload too big to fail",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,52,56],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":53,"name":54,"problem":55},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":57,"name":58,"problem":59},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]