testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads ยท updates https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos JFrog found that the testmetest npm worm campaign (a Shai-Hulud-descendant credential stealer that SafeDep first documented on Oct 22 2026) had already armed 42 GitHub repositories across 11 legitimate owners. Planted Claude, Gemini, Cursor and VS Code hooks run a .github/init.js wrapper of 12.9 to 13.7 MB, too big for GitHub code search and the contents API to see, that decodes to an npm publisher abusing GitHub Actions OIDC trusted publishing. Remove the malicious testmetest and @iobandamwer packages, treat hosts that installed them as compromised, remove the net-health-checker and pkg-runtime persistence before revoking tokens (the worm wipes ~/ on revocation), and audit repos for the hook files. en Mon, 26 Oct 2026 00:00:00 GMT testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: JFrog reports 42 armed GitHub repositories across 11 legitimate owners, a native-addon variant that decrypts .napi_cache at runtime, and links to the shellpanel scanner exploiting cPanel CVE-2026-41940; no downstream cPanel compromises confirmed. https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos#2026-10-26-35af0ad3 Mon, 26 Oct 2026 00:00:00 GMT high <p><a href="https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos/">Source</a></p> testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: SafeDep documents the testmetest npm packages as a Miasma-family worm and reports no confirmed third-party victims yet. https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos#2026-10-22-7d4e184f Thu, 22 Oct 2026 00:00:00 GMT high <p>testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: SafeDep documents the testmetest npm packages as a Miasma-family worm and reports no confirmed third-party victims yet.</p> testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: Malicious data-pipeline-testmetest@2.0.1 worm release published to npm. https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos#2026-10-21-36cc9f48 Wed, 21 Oct 2026 00:00:00 GMT high <p>testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: Malicious data-pipeline-testmetest@2.0.1 worm release published to npm.</p> testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: JFrog: scripted arming batches hit victim accounts, with commits copying old messages and author dates and appending skip-checks:true. https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos#2026-09-28-4dc703d4 Mon, 28 Sep 2026 00:00:00 GMT high <p>testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: JFrog: scripted arming batches hit victim accounts, with commits copying old messages and author dates and appending skip-checks:true.</p> testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: JFrog: first real smoke waves; eight AsharaFernando18 repos get sidecars on July 23 and two leamasuero repos on July 30. https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos#2026-07-23-1ea5a9ab Thu, 23 Jul 2026 00:00:00 GMT high <p>testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads: JFrog: first real smoke waves; eight AsharaFernando18 repos get sidecars on July 23 and two leamasuero repos on July 30.</p>