Native addon camouflage: 42 armed GitHub repos reveal hidden NPM publisher
Comments on “Native addon camouflage: 42 armed GitHub repos reveal hidden NPM publisher”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
JFrog reports that the testmetest npm campaign reaches 42 armed GitHub repositories across 11 owners. Hooks for AI coding assistants and IDEs launch a hidden CI publisher meant to mint further malicious npm releases. Later packages use a native addon that decrypts a .napi_cache file and stays dormant in CI runners, containers, small VMs and under debuggers. The 13 MB payload blobs evaded GitHub code search and the contents API, so defenders need Git tree enumeration.
Why it ranked
No. 1 of 155 with a score of 0.83. The panel rated it highest on technical depth (0.97) and practical relevance (0.93), lowest on audience breadth (0.75).
- AI judgeJudge 2claude-haiku-5-5
- Detailed supply-chain security investigation of npm and GitHub compromise with decoded payloads, IOCs and remediation; highly actionable and substantiated, though some attribution remains inferential.
- AI judgeJudge 3gpt-5.6-luna
- Detailed malware investigation with decompiled code, hashes, repository enumeration, attack-chain evidence, caveats, and actionable detection guidance. It is highly relevant to software supply-chain, CI/CD, developer-tool, and security practitioners.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.83total under rubric v2.2
- Significance0.78
- Reader interest0.88
- Audience breadth0.75
- Practical relevance0.93
- Substantiated0.91
- Technical depth0.97
- New information0.93
- Counts against: Promotional0.04
- Counts against: Overclaim0.19
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.73 | 0.72 | 0.88 | 0.78 | 0.16 | +0.24 | +0.186 |
| Reader interest | 0.84 | 0.85 | 0.95 | 0.88 | 0.11 | +0.26 | +0.229 |
| Audience breadth | 0.70 | 0.78 | 0.78 | 0.75 | 0.08 | +0.13 | +0.098 |
| Practical relevance | 0.96 | 0.90 | 0.93 | 0.93 | 0.06 | +0.22 | +0.205 |
| Substantiated | 0.97 | 0.85 | 0.91 | 0.91 | 0.12 | +0.05 | +0.046 |
| Technical depth | 1.00 | 0.92 | 0.98 | 0.97 | 0.08 | +0.05 | +0.048 |
| New information | 0.91 | 0.90 | 0.97 | 0.93 | 0.07 | +0.05 | +0.046 |
| Promotional | 0.04 | 0.03 | 0.04 | 0.04 | 0.01 | −0.19 | −0.007 |
| Overclaim | 0.29 | 0.20 | 0.08 | 0.19 | 0.21 | −0.11 | −0.021 |
| Sum of contributions | +0.830 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.830 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/1/"><img src="https://rubric.hrih.si/badge/2026-10-28/1.svg" alt="Ranked #1 on Rubric, 28 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 2 matches source · 4 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
JFrog Security Research identified 42 armed third-party GitHub repositories across 11 legitimate owners connected to the testmetest npm campaign.
The article gives no link or citation for it.
The article says “JFrog Security Research has identified 42 armed third-party GitHub repositories across 11 legitimate owners connected to the testmetest npm campaign”
The source says No source to compare with.
Couldn’t checkDate
SafeDep's October 22 analysis first documented the npm/package side of this activity and decoded event-bus-lite-testmetest@0.0.1.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “SafeDep's October 22 analysis first documented the npm/package side of this activity and decoded event-bus-lite-testmetest@0.0.1”
The source says No passage could be compared.
Source cited by the article: safedep.io/testmetest-npm-worm-miasma-variant
Couldn’t checkQuote
At publication time, SafeDep reported it had not confirmed compromised third-party packages or victims.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “At publication time, SafeDep reported that it had not confirmed compromised third-party packages or victims”
The source says No passage could be compared.
Source cited by the article: safedep.io/testmetest-npm-worm-miasma-variant
No source givenCausal conclusion
GitHub code search did not index the 12.9 to 13.7 MB payload blobs, and the contents API could not return files of that size, so initial sweeps wrongly concluded the init.js files were empty.
The article gives no link or citation for it.
The article says “GitHub code search did not index the 12.9 to 13.7 MB blobs, and the contents API could not return files of that size”
The source says No source to compare with.
No source givenNumber
The registry inventory of the campaign spans 25 package names and 82 known version records as of October 26.
The article gives no link or citation for it.
The article says “As of October 26, the registry inventory spans 25 package names and 82 known version records”
The source says No source to compare with.
Matches sourceDate
Socket's July 22, 2026 report documented a campaign abusing GitHub Actions runners to scan for and exploit internet-facing cPanel and WHM systems, including the same server at 43.228.157.68.
The cited source says the same thing.
The article says “Socket's July 22, 2026 report documented a broad campaign that abused GitHub Actions runners to scan for and exploit internet-facing cPanel and WHM systems”
The source says “A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials”
Source cited by the article: socket.dev/blog/github-actions-abuse-powers-cpanel-and-whm-exploitation
Matches sourceNumber
CVE-2026-41940 is an authentication bypass affecting cPanel & WHM and WP Squared, and CISA added it to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
The cited source says the same thing.
The article says “CVE-2026-41940 is an authentication bypass affecting cPanel & WHM and WP Squared”
The source says “CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability”
Source cited by the article: cisa.gov/news-events/alerts/2026/04/30/cisa-adds-one-known-exploited-vulnerability-catalog
No source givenGeneralization
The native addon runs the payload only on real developer machines or servers and stays dormant in CI runners, containers, sandboxes and under debuggers, making it harder for scanners to catch.
The article gives no link or citation for it.
The article says “the payload fires on a real developer laptop or a regular server, and stays asleep inside the CI runners, containers and sandboxes that automated package scanners use”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.