testmetest npm campaign hijacks 42 GitHub repositories to steal credentials
Original title: Malicious npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials and Spread Malware
JFrog links the worm to hidden CI publishers on short-lived branches; disabling install scripts does not stop a newer import-triggered path.
Researchers found 42 weaponized GitHub repositories owned by 11 legitimate developers in the testmetest npm campaign. Payloads steal credentials, hook Claude, Gemini, Cursor and VS Code sessions, and publish further packages, including through a hidden ci.js publisher and fake CodeQL workflows. Later packages use compiled Node addons that decrypt a .napi_cache file. Workflows also tried CVE-2026-41940 against cPanel; JFrog did not confirm successful downstream compromise. Attribution to the original Miasma operators remains unproven.
Unconfirmed: JFrog did not confirm successful cPanel compromise, and attribution to the original Miasma operators is unproven; recovered automation is not proof every release used it.
- Three distinct npm tokens were recovered across six repositories.
- SafeDep documented @testsecuiitytestme/cache-helper 1.0.1–1.0.3, which runs on import.
- A token-revocation-triggered wiper means persistence must be removed before revoking GitHub tokens.
- Linux and Windows builds check for CI, debuggers and analysis tools before running.
Impact: Stolen developer and npm publishing credentials and further package spread
| Product | Affected |
|---|---|
| npm @testsecuiitytestme/cache-helper | 1.0.1–1.0.3 |
| cPanel | — |
- 1.Isolate affected hosts, preserve workflows, and remove unauthorized hooks, branches and workflows.
- 2.Remove net-health-checker and pkg-runtime persistence before revoking stolen GitHub tokens.
- 3.Rotate exposed credentials and rebuild compromised systems from trusted sources.
- CVEs
- CVE-2026-41940
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1528 Steal Application Access TokenT1059.007 JavaScript
- Malware
- testmetest
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 43.228.157.68 | t’s July investigation. Workflows downloaded /tmp/.svc from 43[.]228[.]157[.]68 and attempted CVE-2026-41940 exploitation against cPa |
From the original article
3 min read at gbhackers.com
Research has identified 42 weaponized GitHub repositories belonging to 11 legitimate owners in the testmetest npm campaign, exposing an operation that combines credential theft, development-tool execution hooks, and malicious package publishing. The findings establish that the campaign extended beyond attacker-controlled test packages into established developers’ repositories.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.