Understand this story
JFrog's security research team discovered 42 GitHub repositories implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions. When users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .github/init.js. JFrog listed 15 npm packages with at least one version judged malicious, and recommended checking affected systems, reviewing repository configurations and workflows, and revoking potentially leaked credentials; SafeDep said the worm installs a wiper that deletes the victim's home directory when the victim revokes the stolen GitHub token.
AI-generated from public reports
Latest development · Report
JFrog found that 42 GitHub repositories were implanted with the npm worm testmetest malicious codeDevelopments
1 confirmed developments
- Source:heise online
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 29
heise online
JFrog found that 42 GitHub repositories were implanted with the npm worm testmetest malicious code
The JFrog security research team found that 42 GitHub repositories were implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions; when users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .github/init.js. JFrog listed 15 npm packages with at least one version judged malicious, and recommended checking affected systems, reviewing repository configurations and workflows, and revoking potentially leaked credentials; SafeDep said the worm installs a wiper that deletes the victim's home directory when the victim revokes the stolen GitHub token.