JFrog found that 42 GitHub repositories were implanted with the npm worm testmetest malicious code
The JFrog security research team found that 42 GitHub repositories were implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions; when users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .github/init.js. JFrog listed 15 npm packages with at least one version judged malicious, and recommended checking affected systems, reviewing repository configurations and workflows, and revoking potentially leaked credentials; SafeDep said the worm installs a wiper that deletes the victim's home directory when the victim revokes the stolen GitHub token.
#Safety / alignment#GitHub#Open-source ecosystem