Malware planted in 42 GitHub repos targets Claude, Gemini and Cursor
Hooks in .github/init.js run at session start; JFrog links the traps to the testmetest npm campaign.
76
Malware
testmetest
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 28, 2026
- Last mentioned2d ago
Timeline
3 articles · newest firsttestmetest npm campaign hijacks 42 GitHub repositories to steal credentials
JFrog links the worm to hidden CI publishers on short-lived branches; disabling install scripts does not stop a newer import-triggered path.
74
Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
76
Related CVEs
by mentions- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
Appears with
- JFrogorganization · 3
- SafeDeporganization · 3
- npmproduct · 3
- GitHubproduct · 2
- GitHub Actionsproduct · 1
- Claudeai model · 1
- net-health-checkermalware · 1
- Shai-Huludmalware · 1
- GitHubvendor · 1
- Geminiai model · 1
- CementBeetleSteeplethreat actor · 1
- cPanel and WHMproduct · 1
- Cursorproduct · 1
- Socketorganization · 1
- cPanelproduct · 1
- ci.jsmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.