testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads
npm *-testmetest and @iobandamwer packages, hijacked GitHub repositories
JFrog found that the testmetest npm worm campaign (a Shai-Hulud-descendant credential stealer that SafeDep first documented on Oct 22 2026) had already armed 42 GitHub repositories across 11 legitimate owners. Planted Claude, Gemini, Cursor and VS Code hooks run a .github/init.js wrapper of 12.9 to 13.7 MB, too big for GitHub code search and the contents API to see, that decodes to an npm publisher abusing GitHub Actions OIDC trusted publishing. Remove the malicious testmetest and @iobandamwer packages, treat hosts that installed them as compromised, remove the net-health-checker and pkg-runtime persistence before revoking tokens (the worm wipes ~/ on revocation), and audit repos for the hook files.
Why this severity: Self-replicating credential-stealing npm worm with a token-revocation wiper; 42 real repos armed, but the packages themselves have small reach
- Started
- Jul 23, 2026
Affected
- data-pipeline-testmetest 2.0.1
- event-bus-lite-testmetest 0.0.1, 0.0.2, 0.0.6
- event-emitter-testmetest 1.0.6, 1.0.7, 3.0.0, 3.0.1, 4.1.0, 5.0.0
- log-rotate-testmetest 1.0.1
- log-sink-testmetest 1.0.1
- net-codec-testmetest 1.0.1
- npm-publish-testmetest 1.0.1
- pixel-map-testmetest 0.0.1, 0.0.2, 0.0.3
- retry-utils-testmetest 1.0.3
- test-brotli-testmetest 1.0.0
- test-brotli2-testmetest 1.0.0
- path-stream-utils-testmetest 0.0.1, 0.0.2
- @iobandamwer/cache-helper 1.0.2 to 1.0.8
- @iobandamwer/native-helper 0.0.1
Fixed in
- No fix: remove the malicious package versions and rebuild affected systems
Timeline5
JFrog reports 42 armed GitHub repositories across 11 legitimate owners, a native-addon variant that decrypts .napi_cache at runtime, and links to the shellpanel scanner exploiting cPanel CVE-2026-41940; no downstream cPanel compromises confirmed.
SafeDep documents the testmetest npm packages as a Miasma-family worm and reports no confirmed third-party victims yet.
Malicious data-pipeline-testmetest@2.0.1 worm release published to npm.
JFrog: scripted arming batches hit victim accounts, with commits copying old messages and author dates and appending skip-checks:true.
JFrog: first real smoke waves; eight AsharaFernando18 repos get sidecars on July 23 and two leamasuero repos on July 30.
Advisories3
News & write-ups2
Posts3
🚨 testmetest goes beyond npm. JFrog Security Research identified 42 armed GitHub repositories across 11 legitimate owners hiding an npm publisher, plus a new native addon that decrypts its payload at runtime and stays dormant in CI, sandboxes, and analysis tools. The campaign
⚠️ Someone is testing a new Miasma-family npm worm in the open ("*-testmetest" packages). Once installed it steals your keys, cloud & AI creds, republishes your packages, backdoors your repos via Claude/Cursor configs, and wipes ~/ if you revoke the stolen GitHub token. Read:
Too big to spot? An npm worm campaign planted malicious payloads in 42 GitHub repos, using oversized files to evade code search and routine API checks.
Notes & caveats
JFrog says the evidence supports 42 armed repos and attempted internet-wide cPanel CVE-2026-41940 exploitation, but no confirmed downstream cPanel compromises. Victim plaintext in the attacker's data sink was not decrypted, so the number of infected hosts is unknown.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
