testmetest npm worm armed 42 GitHub repos with oversized payloads
October 28: outlets added the native-addon and import-triggered paths, three recovered npm tokens, and JFrog’s block-and-branch cleanup advice. No later report updates this incident.
JFrog says a testmetest npm worm armed 42 GitHub repositories owned by 11 developers, with no confirmed cPanel compromises.
JFrog Security Research says attackers modified 42 GitHub repositories belonging to 11 legitimate owners, hiding 12.9–13.7 MB payloads that evade GitHub code search and the contents API. The files hook Claude, Gemini, Cursor, and VS Code, steal credentials, alter repositories and CI, and can wipe a home directory if a stolen GitHub token is revoked. The activity is tied to the testmetest npm campaign and described as Miasma-family, though SafeDep and later reporting leave that lineage unproven. Packages republish through CI, including an import-triggered path that disabling install scripts does not stop. Workflows scanned for CVE-2026-41940 in cPanel and WHM; The Register says the infrastructure is linked to earlier exploitation, while JFrog did not confirm cPanel compromises.
- 42 repositories across 11 owners; JFrog raised an earlier count of 26.
- Payloads are 12.9–13.7 MB and evade GitHub search and the contents API.
- SafeDep logged 18 testmetest packages from October 19 to October 25.
- Three npm tokens were recovered across six repositories, according to GBHackers.
- Remove persistence, including net-health-checker and pkg-runtime, before revoking GitHub tokens.
- JFrog advised blocking 43.228.157.68 and unauthorized chore/ci-* and deps/upd-* branches.
Timeline
dated events in the reporting · oldest first- Sep 28, 2026Fake commits copied old history and set skip-checks:true. · Cyber Security News
- Oct 19, 2026SafeDep began logging testmetest packages, continuing through October 25. · The Register
- Oct 22, 2026SafeDep first documented the npm side and questioned Miasma lineage. · CSO Online
What each outlet adds
beyond the shared facts- The RegisterJuly hijacks, 17 repos on CementBeetleSteeple, and CI/sandbox exit checks.
- CSO OnlineNative addon decrypts .napi_cache; Bun 1.2.18 after AES-128-GCM.
- GBHackersThree npm tokens, ci.js publisher, and import-triggered cache-helper versions.
- Cyber Security NewsCount rose from 26 to 42; September 28 fake commits and named persistence.
- CVEs
- CVE-2026-41940
Coverage
oldest first · one row per article · UTC- · 3d ago
The Register · SecurityFirst report
Miasma npm worm armed 42 GitHub repositories, JFrog says
Oversized blobs hid credential theft and a token-revocation wiper on real developer accounts, not only test repos.
- · 2d ago
CSO Online
Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
- · 2d ago
GBHackers
testmetest npm campaign hijacks 42 GitHub repositories to steal credentials
JFrog links the worm to hidden CI publishers on short-lived branches; disabling install scripts does not stop a newer import-triggered path.
- · 2d ago
Cyber Security News
Malware planted in 42 GitHub repos targets Claude, Gemini and Cursor
Hooks in .github/init.js run at session start; JFrog links the traps to the testmetest npm campaign.
- · 5h ago
DeceptiveDevelopment poisons repos after stealing developer credentials
ESET says the group planted code on npm, PyPI, Packagist, Go modules, and extension stores from April to September 2026.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |