testmetest npm worm arms 42 GitHub repositories with payloads too large for GitHub search

JFrog Security Research reports that the testmetest npm worm campaign had armed 42 third party GitHub repositories across 11 owners since July 2026, hiding its payload in polymorphic wrappers of 12.9 to 13.7 MB, too large for GitHub code search and the contents API to index or return, all decoding to the same hidden CI publisher payload. Malicious npm packages execute index.js through binding.gyp command expansion at install, even without a declared install script, then steal GitHub, npm and other credentials, poison repositories and CI configuration, plant execution hooks for Claude, Gemini, Cursor and VS Code so that opening a repository runs the payload, and propagate through package registries. JFrog also found account hijacks, forged commit timelines, short lived publishing branches and exposed npm credentials, a wiper that deletes a victim's home directory if a stolen GitHub token is revoked, and Shellpanel artifacts linking the cluster to GitHub Actions exploitation of internet facing cPanel systems through CVE-2026-41940. A later variant carries no payload in its compiled native addon and instead decrypts a .napi_cache file at runtime, standing down in CI systems, containers and analysis environments.

SafeDep's independent October 22, 2026 analysis first documented the npm and package side of the campaign and decoded event-bus-lite-testmetest@0.0.1, describing the payload as Miasma family while noting uncertainty about its lineage; JFrog likewise notes that shared tooling is confirmed but that the original Miasma operators are not established as responsible.

Sources: JFrog Security Research; SafeDep; CSO Online