npm worm quietly armed 42 GitHub repos with hidden payload

A self-replicating npm worm tracked as "testmetest" secretly armed 42 real GitHub repositories belonging to 11 owners, hijacking accounts as early as July, JFrog researchers said in a report published on 26 October 2026 and covered by The Register. The campaign had initially been assessed as a harmless test with no victims.

Threat hunters at SafeDep, an open source supply chain security firm, first spotted the campaign the previous week, identifying 18 packages linked to the same operator between 19 and 25 October, including releases containing credential-stealing malware. As of 22 October, SafeDep said it had found no compromised third-party packages and no victims. "All observed activity belongs to the operator's own test accounts," the team wrote.

JFrog's analysis contradicted that. The supply chain security company said the operator "had already armed real repositories belonging to established developers and organizations". According to JFrog, the payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise.

The attackers planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor and VS Code, according to JFrog. These sat alongside polymorphic wrappers — files that change shape between builds to frustrate signature matching — measuring 12.9 to 13.7 MB, which decode a hidden CI-publisher payload. The worm steals credentials, modifies repositories and CI configurations, and spreads through npm packages. It also uses a compiled native add-on to decrypt and launch a separate payload.

Before running, the loader checks for CI runners, containers, sandboxes, debuggers and other signs of automated analysis, and exits silently when it finds them, which reduces the chance of being caught by security scanners. JFrog also found a second build that skips the encrypted file and instead forks, detaches and runs a hard-coded command that pulls a loader from a repository on the operator's own GitHub account. That account, named CementBeetleSteeple, hosted 17 campaign repositories in total.

The worm shares code with June's Miasma Phantom Gyp worm and adds the token-revocation wiper seen in Mini Shai-Hulud, the researchers said. That wiper deletes the victim's home directory when the stolen GitHub token is revoked — meaning the usual first response to a token theft can trigger data destruction.

JFrog connected the operator's account to a shellpanel scanner previously documented by Socket in a large-scale campaign that abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 and steal server credentials. That flaw is an authentication bypass affecting cPanel and WHM. CISA added it to its Known Exploited Vulnerabilities catalog in April, and cPanel has since published patched versions.

"C2 infrastructure were previously reported by Socket; our findings connect them to the testmetest GitHub victim cluster through artifacts and workflows on the same hijacked owners," the JFrog researchers wrote. They added that while they found 42 armed GitHub repositories and attempted internet-wide exploitation, they did not confirm any downstream cPanel compromises.