Miasma Worm Arms 42 GitHub Repos to Execute When You Open Claude Code or Cursor

Miasma's infection sequence exploits the trust AI coding agents place in repository configuration files. When a developer clones a repository and opens it in their IDE, the tool automatically reads and applies settings from well-known config paths. Miasma poisons those paths.

The operator first compromises a repository owner's GitHub account through credential theft or session hijacking, likely sourced from the FortiBleed and similar credential dump pipelines running throughout 2026. Once inside, they commit four malicious configuration files without touching the repository's actual source code, reducing the likelihood that code review or diff inspection will surface the attack:

.claude/settings.json receives a SessionStart hook pointing to the .github/init.js payload. Claude Code's hook system is designed for automation -- running linters, formatters, and security checks when a session opens -- but Miasma hijacks it to execute arbitrary JavaScript before the developer types a single command.

.gemini/settings.json receives a settings override that invokes the same payload through Gemini CLI's initialization path, covering developers who use Google's AI assistant rather than Anthropic's.

.cursor/rules gets a malicious entry that Cursor's rule interpreter evaluates during project load, providing a third execution path for the same payload.

.vscode/tasks.json receives a folder-open task that fires when VS Code opens the workspace, covering the largest installed base of the four targeted tools.

The payload file itself, .github/init.js, contains the actual malware logic wrapped in 12.9 to 13.7 MB of obfuscated code. The oversized blob is the campaign's primary evasion mechanism: GitHub's code search API does not index files above approximately 10 MB, so security teams using GitHub code search to audit repositories for malicious scripts cannot find this payload. The worm's operators clearly understand and exploit this platform-specific limitation.

Internal link: The k0t access broker campaign (FortiGate GlobalProtect credential dump) exposed the credential pipeline that likely supplied the compromised GitHub accounts used to plant these payloads.

JFrog's research identified 42 armed repositories across 11 distinct GitHub account owners. The operator hijacked accounts as early as July 2026 and activated the payload infrastructure gradually over three months before external researchers detected the pattern.

The campaign targets any developer who uses AI coding assistants as part of their workflow. Risk is highest for:

Open source contributors who regularly clone third-party repositories to review, contribute to, or fork code. Any repository in a developer's local workspace that was cloned from one of the 42 compromised repositories is a live threat.

Enterprise development teams running AI-assisted code review workflows where developers routinely open unfamiliar repositories in their IDE during security audits, dependency reviews, or vendor assessment processes.

DevSecOps pipelines that automatically check out external repositories as part of CI/CD dependency scanning. If the pipeline opens repository directories in an environment with Claude Code, Cursor, or VS Code installed, the payload executes in the pipeline context, potentially stealing CI/CD secrets.

Freelancers and contractors who clone client repositories frequently and work across multiple projects, providing attackers with access to credentials spanning dozens of organizations from a single infection.

JFrog linked the testmetest operator account to a separate cPanel exploitation campaign, suggesting this is a financially motivated threat actor with an established infrastructure for monetizing compromised developer credentials through access sales to ransomware operators. The overlap with the broader Miasma toolkit, whose source code leaked publicly in June 2026, indicates the barrier to entry for this attack class has dropped significantly since the leak.

For coverage of a similar multi-target supply chain attack hitting enterprise Microsoft 365 environments, see Storm-0940 and ARTEX AI: ConnectWise-Linked M365 Supply Chain Attack.

Miasma's payload executes a systematic credential sweep across the developer's machine before establishing a persistent exfiltration channel. The worm targets credentials stored in the locations where developers most commonly leave them: environment files, IDE configuration, shell profiles, and package manager auth stores.

The exfiltration inventory includes GitHub and GitLab personal access tokens, npm and PyPI authentication tokens, cloud provider credentials (AWS ~/.aws/credentials, GCP ~/.config/gcloud, Azure ~/.azure), SSH private keys from ~/.ssh, AI provider API keys (Claude, Gemini, OpenAI) from IDE config files and environment variables, and any secrets stored in .env files within the project directory and its parents.

Stolen credentials are tagged with the PAT-exfiltration beacon string "DontRevokeOrItGoesBoom" in the exfiltration HTTP request, indicating to attacker infrastructure that a live credential set has arrived. This beacon string doubles as a wiper trigger condition: if the stolen GitHub personal access token is subsequently revoked, the worm's persistence module detects the revocation through periodic beacon failures and activates a wiper targeting the developer's home directory.

The wiper mechanism fundamentally changes the response calculus for affected organizations. Standard incident response instinct is to immediately revoke compromised tokens, but doing so without first backing up the developer's home directory risks destroying weeks or months of local work, uncommitted code, and configuration data. Organizations must coordinate home directory backups, notify affected developers, and execute token revocations through their identity provider's web console -- not through local credential invalidation -- to deny the wiper its trigger condition.

JFrog researchers note that the cPanel exploitation overlap suggests the operator has an established pipeline for converting stolen developer credentials into enterprise network access sales, following the same initial-access-broker pattern documented across the ransomware supply chain.

Miasma leaves four categories of artifacts in infected repositories and on developer machines. Check each in the order listed -- the repository-level checks are fast and non-destructive, while the process-level checks require live monitoring.

Repository artifacts: The primary indicator is an oversized .github/init.js file. Any .github/init.js above 5 MB warrants immediate investigation. The Miasma variant sizes this file between 12.9 and 13.7 MB. Secondary repository indicators include unexpected entries in .claude/settings.json (SessionStart hook pointing to a script), .cursor/rules (command execution entries), .gemini/settings.json (initialization script overrides), and .vscode/tasks.json (folder-open type tasks invoking external scripts).

Process artifacts: Monitor for IDE or coding agent processes (cursor, code, claude, node) spawning unexpected child processes including bash, sh, python3, curl, or wget immediately after a repository is opened. Legitimate IDE activity rarely spawns shell interpreters at project open time.

Network artifacts: Outbound HTTP requests from developer machines containing the string "DontRevokeOrItGoesBoom" in headers or body content indicate active PAT exfiltration. Requests to URI paths matching "TheBeautifulSandsOfTime" indicate second-stage payload delivery.

Credential access artifacts: Unusual access patterns on ~/.aws/credentials, ~/.ssh/id_rsa, and .env files immediately following an IDE session open indicate Miasma credential sweep activity.

These two rules target the primary execution indicators: malicious configuration file creation in AI coding agent paths and shell processes spawned by IDE parent processes at project open time. Both carry experimental status; validate against your environment's baseline IDE behavior before enabling automatic blocking.

Execute these steps in order. Do not revoke tokens before completing step 2 -- the Miasma wiper activates on PAT revocation and destroys home directory data if triggered before you have a backup.

The Miasma testmetest campaign marks a meaningful escalation in supply chain attack sophistication. Earlier supply chain attacks targeted the package manager layer -- malicious npm or PyPI packages that developers install as dependencies. Miasma bypasses the package manager entirely by targeting the IDE and AI coding agent layer, exploiting a trust relationship that most security teams have not modeled in their threat frameworks.

The specific targeting of Claude Code, Gemini CLI, Cursor, and VS Code is significant. These tools sit at the highest-privilege point in a developer's workflow: they run with the developer's credentials, access every file the developer can access, and are actively extended through plugin and hook ecosystems that execute arbitrary code by design. A malicious hook inserted into a trusted tool's configuration is harder to detect than a malicious package because the hook looks like legitimate configuration -- the kind of file security teams assume the developer wrote.

The payload sizing strategy, engineering the .github/init.js to exceed GitHub's 10 MB code search threshold, demonstrates the operator's detailed knowledge of platform security controls and their deliberate exploitation. This is not a script kiddie operation; it is a financially motivated actor who studied the platform's limitations before deploying the campaign.

The wiper mechanism compresses the incident response timeline in a way defenders need to plan for explicitly. Traditional token-rotation responses become dangerous when the token revocation itself triggers destruction of developer assets. Organizations need pre-positioned playbooks that cover: confirm backup before revoke, coordinate simultaneous revocations, and treat the developer machine as fully compromised rather than as a repairable endpoint.

For security teams: add AI coding agent configuration directories (.claude, .cursor, .gemini) to your file integrity monitoring baseline. Treat unexpected modifications to these paths the same way you treat unexpected modifications to sudoers or crontab -- as high-priority alerts requiring immediate investigation. The attack surface opened by AI coding tools is real, active, and currently underdefended.