A self-replicating npm worm that initially appeared to be a harmless test had in fact compromised 42 GitHub repositories belonging to 11 owners, with accounts hijacked as early as July, according to security researchers at JFrog.
Researchers at JFrog say the 'testmetest' npm worm, originally believed to be just a test with no victims, secretly armed 42 real GitHub repositories from 11 owners, hijacking accounts as early as July. The supply chain security firm said the campaign used a stealthy payload built to stay hidden from GitHub and automated scanners.
SafeDep, an open source supply chain security firm, first spotted the campaign last week, identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware. As of October 22, SafeDep had found no compromised third-party packages or victims. 'All observed activity belongs to the operator's own test accounts,' the team wrote.
JFrog's Monday report reached the opposite conclusion. The operator 'had already armed real repositories belonging to established developers and organizations,' JFrog researchers wrote, and the payload blobs 'were large enough to evade the GitHub search and API paths normally used to find this kind of compromise.'
Like earlier npm worms, the malware self-replicates, steals credentials, and installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token. It shares code with June's Miasma Phantom Gyp worm and adds Mini Shai-Hulud's token-revocation wiper. The attackers planted execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor and VS Code, alongside polymorphic wrappers measuring 12.9 to 13.7 MB that decode a hidden CI-publisher payload. A compiled native add-on decrypts and launches a separate payload, while the loader checks for CI runners, containers, sandboxes, debuggers and other signs of automated analysis, exiting silently if it detects them to avoid detection by security scanners.
JFrog also found a second build that skips the encrypted file. 'It forks, detaches and runs a hard-coded command that pulls a loader from a repository on the operator's own GitHub account,' the researchers wrote. That account, CementBeetleSteeple, hosted 17 campaign repositories. JFrog connected it to a shellpanel scanner previously documented by Socket in a campaign that abused GitHub Actions in compromised repositories to exploit CVE-2026-41940, an authentication bypass affecting cPanel and WHM, and steal server credentials. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog in April, and cPanel has since published patched versions.
JFrog said it found 42 armed GitHub repositories and attempted internet-wide exploitation, but did not confirm any downstream cPanel compromises.
Analysis
Why This Matters
- The initial assessment that the campaign had no victims proved wrong, meaning the worm's reach is wider than first reported.
- The malware targets developer machines and CI pipelines, which can expose credentials and inject malicious code into software shipped to downstream users.
- A token-revocation wiper deletes the home directory when a victim revokes a stolen GitHub token, making incident response destructive.
Background
The testmetest campaign is a self-replicating npm worm that steals credentials, modifies repositories and CI configurations, and spreads through npm packages. It belongs to the Miasma family and builds on June's Miasma Phantom Gyp worm with the addition of Mini Shai-Hulud's token-revocation wiper. SafeDep detected the campaign in late October and initially saw only the operator's own test accounts; JFrog's follow-up linked the operation to a shellpanel scanner previously documented by Socket, which abused GitHub Actions in compromised repositories to exploit CVE-2026-41940, a cPanel and WHM authentication bypass.
Key Perspectives
SafeDep: As of October 22, had found no compromised third-party packages or victims, writing that 'all observed activity belongs to the operator's own test accounts.'
JFrog researchers Guy Korolevski and Yair Benamou: Found the operator 'had already armed real repositories belonging to established developers and organizations,' and said the payload blobs were large enough to evade GitHub's normal search and API detection paths.
What to Watch
- Whether cPanel or WHM servers show downstream compromises, which JFrog said it did not confirm.
- Whether GitHub takes action against the 42 armed repositories and the CementBeetleSteeple account.
- Whether further packages or armed repositories surface as the wiper's effects come to light.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedThe worm secretly armed 42 GitHub repositories.www.theregister.com - Articles: “secretly armed 42 real GitHub repositories from 11 owners”
- Partly supportedThe campaign had compromised 42 GitHub repositories.www.theregister.com - Articles: “secretly armed 42 real GitHub repositories from 11 owners”
- SupportedAccounts were hijacked as early as July.www.theregister.com - Articles: “hijacking accounts as early as July”
- SupportedSafeDep identified 18 packages linked to the operator between October 19 and October 25, including releases with credential-stealing malware.www.theregister.com - Articles: “identifying 18 packages linked to the same operator between October 19 and October 25, including releases containing credential-stealing malware.”
- SupportedAs of October 22, SafeDep had found no compromised third-party packages or victims.www.theregister.com - Articles: “As of October 22, however, SafeDep had found no compromised third-party packages or victims.”
- SupportedSafeDep wrote, “All observed activity belongs to the operator's own test accounts.”www.theregister.com - Articles: ““All observed activity belongs to the operator’s own test accounts,” the team wrote.”
- SupportedJFrog researchers wrote that the operator “had already armed real repositories belonging to established developers and organizations.”www.theregister.com - Articles: ““had already armed real repositories belonging to established developers and organizations.””
- SupportedJFrog researchers wrote that the payload blobs were large enough to evade the usual GitHub search and API paths for finding this kind of compromise.www.theregister.com - Articles: ““The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise,” they wrote.”
- SupportedThe malware installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token.www.theregister.com - Articles: “installs a wiper that deletes the home directory when the victim revokes the stolen GitHub token”
- SupportedPolymorphic wrappers measuring 12.9 to 13.7 MB decode a hidden CI-publisher payload.www.theregister.com - Articles: “alongside polymorphic wrappers measuring 12.9 to 13.7 MB that decode a hidden CI-publisher payload.”
- SupportedJFrog researchers wrote that the second build forks, detaches and runs a hard-coded command to pull a loader from a repository on the operator's GitHub account.www.theregister.com - Articles: ““It forks, detaches and runs a hard-coded command that pulls a loader from a repository on the operator's own GitHub account,” they wrote.”
- SupportedThe operator's account, CementBeetleSteeple, hosted 17 campaign repositories.www.theregister.com - Articles: “That account – CementBeetleSteeple – hosted 17 campaign repositories in total.”
