Attackers hijack 42 GitHub repositories in npm worm campaign “testmetest”
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
JFrog found 42 GitHub repositories, belonging to 11 legitimate owners, planted with malware tied to the "testmetest" npm worm, which it says resembles Shai-Hulud variants. Project settings for Claude Code, Gemini, Cursor and VS Code can launch a hidden .github/init.js that targets GitHub and npm tokens. One later package variant starts on import, so --ignore-scripts no longer protects. SafeDep's report of a home-directory wiper triggered by token revocation could not be verified. The number of victims is unknown.