Malicious npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials and Spread Malware

Research has identified 42 weaponized GitHub repositories belonging to 11 legitimate owners in the testmetest npm campaign, exposing an operation that combines credential theft, development-tool execution hooks, and malicious package publishing.

The findings establish that the campaign extended beyond attacker-controlled test packages into established developers’ repositories.

Researchers Guy Korolevski and Yair Benamou uncovered oversized payload wrappers, forged commit histories, short-lived publishing branches, and workflows masquerading as CodeQL scans.

Their October 26 investigation connects the npm worm to a hidden CI publisher and separately documented cPanel exploitation infrastructure, while distinguishing confirmed compromises from attempted downstream exploitation.

Early malicious releases executed index.js through command expansion inside binding.gyp, despite lacking conventional installation scripts.

The loader combined Caesar-style character transformations, AES-128-GCM decryption, and a Bun 1.2.18 bootstrap to launch the credential-stealing payload.

Notably, event-bus-lite-testmetest@0.0.2 carried both the full worm and a separate publisher-family payload, directly connecting package infection with malicious release automation.

Inside compromised repositories, attackers planted .github/init.js alongside Claude, Gemini, Cursor, and VS Code execution configurations.

Supported session-start and workspace-opening actions could launch the payload without an explicit developer command.

The files measured approximately 12.9–13.7 MB, escaping the GitHub search and content-retrieval paths initially used by investigators.

Direct Git tree and blob enumeration revealed ten distinct wrappers that decrypted to the same publisher payload; differences reflected encoding rather than additional capabilities.

Later packages, including @iobandamwer/cache-helper, @iobandamwer/native-helper, and path-stream-utils-testmetest, replaced readable JavaScript loaders with compiled Node.js addons.

These binaries decrypted an adjacent .napi_cache file using XOR key 0x96, then launched the recovered JavaScript in detached processes.

JFrog Security Research observed that, the worm harvested credentials, modified repositories and CI configurations, and propagated through package registries.

npm Targets GitHub Repositories

Linux builds checked CI variables, container markers, memory, processor counts, and debugger status before execution. Windows variants additionally detected tools including Wireshark, Process Monitor, and x64dbg.

These checks suppressed execution in many automated analysis environments while targeting ordinary developer systems.

Several looked like normal source repositories on their default branches, but short-lived branches named chore/ci-<hex> carried a root-level ci.js and an Actions workflow. 

In an October 27 update, SafeDep documented @testsecuiitytestme/cache-helper versions 1.0.1–1.0.3, which trigger the worm when an application imports the package.

Consequently, disabling installation scripts alone does not prevent this newer execution path.

The attacker’s CementBeetleSteeple account hosted publishing infrastructure on transient chore/ci-* branches.

Recovered code harvested tokens, inspected trusted-publishing permissions, and implemented GitHub OpenID Connect exchanges for npm publishing credentials.

This demonstrates the intended automation, not proof that every malicious release used it.

Fake CodeQL workflows exported environment variables into scan-output artifacts. Researchers recovered three distinct npm tokens across six repositories.

Separately, stable-scripts-9965 accumulated 27 encrypted snapshot files by October 25; their metadata did not establish victim identities or plaintext contents.

Shellpanel artifacts also connected the compromised owner cluster to infrastructure described in Socket’s July investigation.

Workflows downloaded /tmp/.svc from 43[.]228[.]157[.]68 and attempted CVE-2026-41940 exploitation against cPanel services. JFrog did not confirm successful downstream compromise.

Defenders should isolate affected hosts, preserve workflow evidence, enumerate repository trees directly, and remove unauthorized hooks, branches, and workflows.

Remove net-health-checker and pkg-runtime persistence before revoking stolen GitHub tokens: the worm includes a token-revocation-triggered wiper.

Then rotate exposed credentials and rebuild compromised systems from trusted sources. Attribution to the original Miasma operators remains unproven.

IOCs

Package	Xray ID
data-pipeline-testmetest	XRAY-1141820
event-bus-lite-testmetest	XRAY-1143287
event-emitter-testmetest	XRAY-1141833
log-rotate-testmetest	XRAY-1143202
log-sink-testmetest	XRAY-1143131
net-codec-testmetest	XRAY-1143203

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.