Native addon camouflage: 42 armed GitHub repos reveal hidden NPM publisher

JFrog reports that the testmetest npm campaign reaches 42 armed GitHub repositories across 11 owners. Hooks for AI coding assistants and IDEs launch a hidden CI publisher meant to mint further malicious npm releases. Later packages use a native addon that decrypts a .napi_cache file and stays dormant in CI runners, containers, small VMs and under debuggers. The 13 MB payload blobs evaded GitHub code search and the contents API, so defenders need Git tree enumeration.