Malware planted in 42 GitHub repos targets Claude, Gemini and Cursor
Original title: Hackers Hijack 42 GitHub Repositories to Plant Malware Traps for Claude, Gemini, and Cursor Users
Hooks in .github/init.js run at session start; JFrog links the traps to the testmetest npm campaign.
JFrog Security Research found 42 repositories belonging to 11 legitimate owners modified so Claude, Gemini, Cursor or VS Code runs a large .github/init.js payload when a session starts or a folder opens. The operator, tied to the testmetest npm worm, used stolen GitHub and npm access to publish malicious packages and to scan for cPanel and WHM systems affected by CVE-2026-41940. JFrog reported no confirmed cPanel compromises. Defenders are told to remove named persistence before revoking stolen GitHub tokens.
Unconfirmed: JFrog found no proof any cPanel server was breached, and SafeDep reported no confirmed npm victims.
- JFrog raised the count from 26 to 42 repositories across 11 owners.
- The .github/init.js file is 12.9 MB to 13.7 MB and evades GitHub search.
- On September 28, fake commits copied old history and added skip-checks:true.
- Remove net-health-checker and pkg-runtime before revoking the GitHub token.
- Scanners seek cPanel CVE-2026-41940; JFrog found no confirmed breaches.
Impact: Malware runs when AI coding tools open a hijacked repository.
| Product | Affected |
|---|---|
| cPanel and WHM | — |
- 1.Remove malicious package versions and rebuild affected systems from trusted sources.
- 2.Rotate GitHub, npm, cloud, SSH, and AI-provider credentials.
- 3.Remove net-health-checker and pkg-runtime before revoking the stolen GitHub token.
- CVEs
- CVE-2026-41940
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1078 Valid AccountsT1204.002 Malicious FileT1027 Obfuscated Files or InformationT1497 Virtualization/Sandbox Evasion
- Threat actors
- CementBeetleSteeple
- Victims
- Crayon-Biz-LLP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aiarmor.website | dl/<amd64\|386\|arm\|arm64> Exfiltration endpoint hxxps[:]//aiarmor[.]website/v1/api Native addon loader download hxxps[:]//raw[.]githu |
| domain | raw.githubusercontent.com | mor[.]website/v1/api Native addon loader download hxxps[:]//raw[.]githubusercontent[.]com/CementBeetleSteeple/node-cache-utils/main/loader.js Git |
| ipv4 | 43.228.157.68 | Indicators of compromise (IoCs):- Type Indicator Scanner C2 43[.]228[.]157[.]68:80 Scanner download pattern hxxp[:]//43[.]228[.]157[. |
| sha256 | 17614e98b613b17d0e1bb7125ab203715dd397661b897d8d18dbb77864c1839f | 83daaf231a04ee90d4690962c73 SHA-256, Shellpanel marker tool 17614e98b613b17d0e1bb7125ab203715dd397661b897d8d18dbb77864c1839f Files and paths .github/init.js , /tmp/.svc , addon.node , |
| sha256 | 3dc40fc55302664c07c9d9182ffd95910aeb366fcd417fbdad0a90cdeb8ea69e | dfdcfbdb5ae1a1556c23cc4793 SHA-256, victim Bun bootstrap _b 3dc40fc55302664c07c9d9182ffd95910aeb366fcd417fbdad0a90cdeb8ea69e SHA-256, ci.js publisher payload 8506042b383ab46545c27a402e |
| sha256 | 783a4ac906cc9b2eaf5cd13408ea95db6ce52a46d9af11aad1a5b167af69589f | 71181b175b1d87972843a43 SHA-256, ci.js v3 publisher payload 783a4ac906cc9b2eaf5cd13408ea95db6ce52a46d9af11aad1a5b167af69589f SHA-256, stable-scripts-9965 loader a516dd7867af83f8be0cc3e |
| sha256 | 7ad216b3afd2f40a147c80733c7309fb3d3a7f52ee78149c8e51672cfb617d07 | ded1e14e0c57 SHA-256, stable-scripts-9965 publisher payload 7ad216b3afd2f40a147c80733c7309fb3d3a7f52ee78149c8e51672cfb617d07 SHA-256, Shellpanel mock e3cb383615fc70bce9b5bcd1c7a394132b |
| sha256 | 8506042b383ab46545c27a402eb2dc973696a93af71181b175b1d87972843a43 | 6fcd417fbdad0a90cdeb8ea69e SHA-256, ci.js publisher payload 8506042b383ab46545c27a402eb2dc973696a93af71181b175b1d87972843a43 SHA-256, ci.js v3 publisher payload 783a4ac906cc9b2eaf5cd13 |
| sha256 | 9d83919bfdb0e14018f1a6f2b8b6586de59b60dfdcfbdb5ae1a1556c23cc4793 | tream-utils-testmetest SHA-256, victim publisher payload _p 9d83919bfdb0e14018f1a6f2b8b6586de59b60dfdcfbdb5ae1a1556c23cc4793 SHA-256, victim Bun bootstrap _b 3dc40fc55302664c07c9d9182f |
| sha256 | a516dd7867af83f8be0cc3e926fdfd964097f0e7665596b05fe5234be7e2b5e9 | 9af11aad1a5b167af69589f SHA-256, stable-scripts-9965 loader a516dd7867af83f8be0cc3e926fdfd964097f0e7665596b05fe5234be7e2b5e9 SHA-256, stable-scripts-9965 decoded stage ccfd769acc024edc |
| sha256 | ccfd769acc024edc409ef879198d2a2398beee60930f2b3f2771ded1e14e0c57 | 5fe5234be7e2b5e9 SHA-256, stable-scripts-9965 decoded stage ccfd769acc024edc409ef879198d2a2398beee60930f2b3f2771ded1e14e0c57 SHA-256, stable-scripts-9965 publisher payload 7ad216b3afd2 |
| sha256 | e3cb383615fc70bce9b5bcd1c7a394132b50483daaf231a04ee90d4690962c73 | fb3d3a7f52ee78149c8e51672cfb617d07 SHA-256, Shellpanel mock e3cb383615fc70bce9b5bcd1c7a394132b50483daaf231a04ee90d4690962c73 SHA-256, Shellpanel marker tool 17614e98b613b17d0e1bb7125ab |
| url | http://43.228.157.68:80/api/dl/ | Scanner C2 43[.]228[.]157[.]68:80 Scanner download pattern hxxp[:]//43[.]228[.]157[.]68:80/api/dl/<amd64\|386\|arm\|arm64> Exfiltration endpoint hxxps |
| url | https://aiarmor.website/v1/api | 68:80/api/dl/<amd64\|386\|arm\|arm64> Exfiltration endpoint hxxps[:]//aiarmor[.]website/v1/api Native addon loader download hxxps[:]//raw[.]githubuser |
| url | https://raw.githubusercontent.com/CementBeetleSteeple/node-cache-utils/main/loader.js | s[:]//aiarmor[.]website/v1/api Native addon loader download hxxps[:]//raw[.]githubusercontent[.]com/CementBeetleSteeple/node-cache-utils/main/loader.js GitHub operator account CementBeetleSteeple Campaign |
From the original article
4 min read at cybersecuritynews.com
Hackers have quietly planted malware in 42 real GitHub repositories. The traps fire when a developer opens a project with Claude, Gemini, Cursor, or VS Code. The repositories belong to 11 legitimate owners, including individual developers, students, and one company.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.