# testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads · pwn.watch

> JFrog found that the testmetest npm worm campaign (a Shai-Hulud-descendant credential stealer that SafeDep first documented on Oct 22 2026) had already armed 42 GitHub repositories across 11 legitimate owners. Planted Claude, Gemini, Cursor and VS Code hooks run a .github/init.js wrapper of 12.9 to 13.7 MB, too big for GitHub code search and the contents API to see, that decodes to an npm publisher abusing GitHub Actions OIDC trusted publishing. Remove the malicious testmetest and @iobandamwer packages, treat hosts that installed them as compromised, remove the net-health-checker and pkg-runtime persistence before revoking tokens (the worm wipes ~/ on revocation), and audit repos for the hook files.

Page: https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos · generated 2026-10-27T00:44:00.319Z

## Status
- Severity: high · status: live · patch: partial
- Product: npm *-testmetest and @iobandamwer packages, hijacked GitHub repositories
- Started: 2026-07-23
- CVEs: GHSA-7rwv-2p3x-mch4, GHSA-26g3-4jrv-x55w, GHSA-r5cq-2h3p-f6qf
- Affected: data-pipeline-testmetest 2.0.1; event-bus-lite-testmetest 0.0.1, 0.0.2, 0.0.6; event-emitter-testmetest 1.0.6, 1.0.7, 3.0.0, 3.0.1, 4.1.0, 5.0.0; log-rotate-testmetest 1.0.1; log-sink-testmetest 1.0.1; net-codec-testmetest 1.0.1; npm-publish-testmetest 1.0.1; pixel-map-testmetest 0.0.1, 0.0.2, 0.0.3; retry-utils-testmetest 1.0.3; test-brotli-testmetest 1.0.0; test-brotli2-testmetest 1.0.0; path-stream-utils-testmetest 0.0.1, 0.0.2; @iobandamwer/cache-helper 1.0.2 to 1.0.8; @iobandamwer/native-helper 0.0.1
- Fixed in: No fix: remove the malicious package versions and rebuild affected systems

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos/feed.xml
- JSON Feed: https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos.json
- This file: https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos/llms.txt

## Updates (newest first)
- 2026-10-26: JFrog reports 42 armed GitHub repositories across 11 legitimate owners, a native-addon variant that decrypts .napi_cache at runtime, and links to the shellpanel scanner exploiting cPanel CVE-2026-41940; no downstream cPanel compromises confirmed. (https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos/)
- 2026-10-22: SafeDep documents the testmetest npm packages as a Miasma-family worm and reports no confirmed third-party victims yet.
- 2026-10-21: Malicious data-pipeline-testmetest@2.0.1 worm release published to npm.
- 2026-09-28: JFrog: scripted arming batches hit victim accounts, with commits copying old messages and author dates and appending skip-checks:true.
- 2026-07-23: JFrog: first real smoke waves; eight AsharaFernando18 repos get sidecars on July 23 and two leamasuero repos on July 30.

## Fix brief
# Security brief: testmetest npm worm armed 42 real GitHub repos with hidden 13 MB payloads

Source: https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos · status: live · severity: high · updated Oct 26, 2026, 22:38 UTC

## Patch status
**PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.**

## What it is
JFrog found that the testmetest npm worm campaign (a Shai-Hulud-descendant credential stealer that SafeDep first documented on Oct 22 2026) had already armed 42 GitHub repositories across 11 legitimate owners. Planted Claude, Gemini, Cursor and VS Code hooks run a .github/init.js wrapper of 12.9 to 13.7 MB, too big for GitHub code search and the contents API to see, that decodes to an npm publisher abusing GitHub Actions OIDC trusted publishing. Remove the malicious testmetest and @iobandamwer packages, treat hosts that installed them as compromised, remove the net-health-checker and pkg-runtime persistence before revoking tokens (the worm wipes ~/ on revocation), and audit repos for the hook files.

Severity detail: Self-replicating credential-stealing npm worm with a token-revocation wiper; 42 real repos armed, but the packages themselves have small reach

- Product: npm *-testmetest and @iobandamwer packages, hijacked GitHub repositories
- CVE / advisory ids: GHSA-7rwv-2p3x-mch4, GHSA-26g3-4jrv-x55w, GHSA-r5cq-2h3p-f6qf

## Affected versions
- data-pipeline-testmetest 2.0.1
- event-bus-lite-testmetest 0.0.1, 0.0.2, 0.0.6
- event-emitter-testmetest 1.0.6, 1.0.7, 3.0.0, 3.0.1, 4.1.0, 5.0.0
- log-rotate-testmetest 1.0.1
- log-sink-testmetest 1.0.1
- net-codec-testmetest 1.0.1
- npm-publish-testmetest 1.0.1
- pixel-map-testmetest 0.0.1, 0.0.2, 0.0.3
- retry-utils-testmetest 1.0.3
- test-brotli-testmetest 1.0.0
- test-brotli2-testmetest 1.0.0
- path-stream-utils-testmetest 0.0.1, 0.0.2
- @iobandamwer/cache-helper 1.0.2 to 1.0.8
- @iobandamwer/native-helper 0.0.1

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- No fix: remove the malicious package versions and rebuild affected systems

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Mitigations
The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Oct 26, 2026: JFrog reports 42 armed GitHub repositories across 11 legitimate owners, a native-addon variant that decrypts .napi_cache at runtime, and links to the shellpanel scanner exploiting cPanel CVE-2026-41940; no downstream cPanel compromises confirmed.
- Oct 22, 2026: SafeDep documents the testmetest npm packages as a Miasma-family worm and reports no confirmed third-party victims yet.
- Oct 21, 2026: Malicious data-pipeline-testmetest@2.0.1 worm release published to npm.
- Sep 28, 2026: JFrog: scripted arming batches hit victim accounts, with commits copying old messages and author dates and appending skip-checks:true.
- Jul 23, 2026: JFrog: first real smoke waves; eight AsharaFernando18 repos get sidecars on July 23 and two leamasuero repos on July 30.

## Advisories
- [Malicious code in log-sink-testmetest (npm), GHSA-7rwv-2p3x-mch4](https://github.com/advisories/GHSA-7rwv-2p3x-mch4) (GitHub)
- [Malicious code in pixel-map-testmetest (npm), GHSA-26g3-4jrv-x55w](https://github.com/advisories/GHSA-26g3-4jrv-x55w) (GitHub)
- [Malicious code in test-brotli-testmetest (npm), GHSA-r5cq-2h3p-f6qf](https://github.com/advisories/GHSA-r5cq-2h3p-f6qf) (GitHub)

## Write-ups & news
- [Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher](https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos/)
- [Worm armed 42 GitHub repos by hiding a payload too big to fail](https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570)

## Caveats
JFrog says the evidence supports 42 armed repos and attempted internet-wide cPanel CVE-2026-41940 exploitation, but no confirmed downstream cPanel compromises. Victim plaintext in the attacker's data sink was not decrypted, so the number of infected hosts is unknown.

---
Machine-readable: https://pwn.watch/i/testmetest-npm-worm-42-armed-github-repos.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.