42 GitHub repositories compromised with testmetest malware

Security researchers at JFrog have uncovered 42 third-party GitHub repositories prepared to execute malicious code as part of the ongoing testmetest campaign. The attackers embedded loaders for a hidden npm package publisher alongside autorun commands targeting popular development environments and AI tools such as Claude Code, Cursor, Gemini CLI, and VS Code.

• The malicious loaders are approximately 13 MB in size and do not appear in standard GitHub code search results.
• Attack vectors include automated configuration triggers that can execute before dependencies are ever installed.
• The worm steals secrets and leverages trusted npm publishing via GitHub Actions to propagate malicious packages.

Campaign Scale and Infection Vectors

Just days prior, security firm SafeDep reported on the initial discovery of this worm, though activity at the time was observed only within the attacker's test accounts. JFrog's findings significantly escalate the estimated scale of the campaign, revealing implementations inside genuine developer and organization repositories. Configurations across various tools were altered to trigger the execution of a .github/init.js file upon session start or folder opening.

The malicious framework bypasses standard security expectations. For instance, the absence of an explicit install script in package.json no longer guarantees safe installation, as execution mechanisms can rely on native module build files like binding.gyp or Node.js native libraries invoked via postinstall hooks.

Mechanics of the npm Ecosystem Attack

Beneath ten different wrappers lies a unified malicious package publisher designed to hunt for local access tokens and exploit trusted npm publishing workflows configured via GitHub Actions. Because trusted publishing binds package releases to specific repositories and workflows, compromising configuration files allows threat actors to bypass standard provenance checks and push altered code into production.

Experts emphasize that standard dependency scanning alone is insufficient against this vector. Organizations must implement strict monitoring and control over development environment configurations and release pipeline modifications.

Mitigation and Remediation Steps

Security teams are advised to audit repository file trees for the presence of unauthorized .github/init.js files and review workflow history, particularly branches matching chore/ci-* patterns, focusing on publishing steps and secret access permissions.

In the event of an active npm worm infection, systems should be immediately isolated and cleaned of persistence mechanisms before rotating all exposed credentials from a known secure machine.