Threat reportSupply ChainTL-2026-4607
"testmetest" npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials, Abuse GitHub OIDC Publishing and Spread Malware
"testmetest" npm Campaign Hijacks 42 GitHub Repositories to (TL-2026-4607), also tracked as testmetest, is a high-severity supply-chain compromise, first published 2026-10-28. It has no confirmed attribution, affects npm ecosystem Malicious packages (*-testmetest, references 1 CVE (CVE-2026-41940), maps to 23 MITRE ATT&CK techniques (T1027.013, T1036, T1036.004), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 23MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4607
- Threat ID
- TL-2026-4607
- Also known as
- testmetest, Beyond testmetest
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, open-source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
- Updates
- 2026-10-28 · revalidated 1× · latest source
How "testmetest" npm Campaign Hijacks 42 GitHub Repositories to works
A coordinated campaign armed 42 GitHub repositories belonging to 11 legitimate owners with credential-stealing payloads, AI/IDE execution hooks and CI-based npm publishing, spreading through malicious *-testmetest npm packages. Early releases executed code via command expansion in binding.gyp, bypassing install-script controls, and the payload can exchange GitHub OIDC tokens for npm publishing credentials and wipe on token revocation.
JFrog Security Research (published 2026-10-26, researchers Guy Korolevski and Yair Benamou) documented a campaign that began as smoke-testing waves in July 2026 and escalated through September and October 2026. The operator account CementBeetleSteeple and a set of hijacked developer and organization accounts were used to plant weaponized files in 42 repositories across 11 legitimate owners, including AsharaFernando18, leamasuero, hakimrasdi, Crayon-Biz-LLP, ismahhaziq and ephronM. Attribution to the original Miasma operators is explicitly unproven; however, Shellpanel artifacts link the cluster to infrastructure in Socket's July 2026 investigation (stable-scripts-9965).
Initial execution occurs when a victim installs a malicious npm package (for example data-pipeline-testmetest@2.0.1, published 2026-10-21, or the @iobandamwer/* and @testsecuiitytestme/* scoped packages). Early releases ran index.js through command expansion in binding.gyp, so disabling npm lifecycle/install scripts does not prevent execution. Later packages ship compiled Node.js addons (addon.node, addon_win.node) that decrypt adjacent .napi_cache files with a single-byte XOR key 0x96 and launch the recovered JavaScript in detached processes. Payload wrappers use Caesar-style character transformations and AES-128-GCM and bootstrap Bun 1.2.18; ten distinct wrappers decrypt to the same publisher payload, so differences reflect encoding rather than new capability.
The payload harvests GitHub and npm tokens from the environment and files, then poisons repositories by planting .github/init.js (about 12.3-13.7 MB polymorphic wrappers) together with execution hooks for AI coding assistants and IDEs: .claude/settings.json, .gemini/settings.json, .cursor/mcp.json, .cursor/rules/setup.mdc and .vscode/tasks.json. Short-lived branches named chore/ci-<hex> carry a root-level ci.js publisher and GitHub Actions workflows, including fake CodeQL workflows that export environment variables to a one-day-retention scan-output artifact; JFrog recovered three distinct npm tokens across six repositories and 29 real npm access tokens captured in such artifacts. ci.js requests a GitHub Actions identity token (ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN) and exchanges it at the npm registry OIDC token-exchange endpoint (trusted-publishing flow with keyOwnerProof/publicKeyRequest) to publish weaponized package versions. Propagation branches follow deps/upd-<digits>; commits use the skip-checks:true trailer and forged author dates, so author timestamps are unreliable. Stolen tokens are dead-dropped via commits prefixed AutoSyncComplete: and snapshots are written as data/snap-<timestamp>-<n>.json (27 encrypted snapshots totalling 384,825 bytes by 2026-10-25 in stable-scripts-9965).
Persistence uses services named net-health-checker (systemd user services / LaunchAgents, ~/.local/bin/net-health-checker.sh, ~/.config/net-health-checker/) and pkg-runtime (~/.local/share/runtimes/sync.py, /var/tmp/.fontconfig_state). The worm contains token-revocation-triggered wiper logic, so remediation order matters: remove net-health-checker and pkg-runtime persistence before revoking stolen GitHub tokens. The compiled addon performs anti-analysis: it silently exits on CI environment variables, container markers in /proc/1/cgroup and /proc/1/cmdline, low-resource VMs (<=1.5 GB RAM or a single CPU) and debugger attachment (TracerPid, IsDebuggerPresent, CheckRemoteDebuggerPresent), and on Windows detects Wireshark, Fiddler, HTTP Debugger, Process Monitor, Process Explorer, x64dbg and OllyDbg.
A secondary 'shellpanel' component downloads a scanner binary (/tmp/.svc) from 43.228.157.68 and runs a mass internet scan with a CVE-2026-41940 exploit option against cPanel & WHM and WP Squared (CISA KEV-listed authentication bypass). JFrog confirmed no successful downstream compromise from this scanning. CVE-2026-41940 is an associated item and is not the vulnerability behind this supply-chain campaign. JFrog Xray and Curation flag all malicious package versions; SafeDep documented newer execution variants on 2026-10-27 (per GBHackers).
MITRE ATT&CK techniques used in TL-2026-4607
Defense Evasion
T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1036.004 Masquerade Task or Service; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1622 Debugger Evasion
Discovery
T1046 Network Service Discovery
Execution
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain
Command and Control
Impact
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.001 Credentials In Files
Persistence
T1543.001 Launch Agent; T1543.002 Systemd Service; T1546 Event Triggered Execution
Exfiltration
T1567 Exfiltration Over Web Service; T1567.001 Exfiltration Over Web Service
Resource Development
T1584 Compromise Infrastructure
Reconnaissance
Affected products and versions in "testmetest" npm Campaign Hijacks 42 GitHub Repositories to
- npm ecosystem — Malicious packages (*-testmetest, @iobandamwer/cache-helper, @iobandamwer/native-helper, @testsecuiitytestme/cache-helper, net-health-checker, pkg-runtime)
Vulnerable versions: data-pipeline-testmetest 2.0.1; event-bus-lite-testmetest 0.0.1, 0.0.2, 0.0.6; event-emitter-testmetest 1.0.6, 1.0.7, 3.0.0, 3.0.1, 4.1.0, 5.0.0; log-rotate-testmetest 1.0.1; log-sink-testmetest 1.0.1; net-codec-testmetest 1.0.1; npm-publish-testmetest 1.0.1; pixel-map-testmetest 0.0.1-0.0.3; retry-utils-testmetest 1.0.3; test-brotli-testmetest 1.0.0 - GitHub — 42 hijacked/armed repositories across 11 owners; GitHub Actions and npm trusted publishing abused
Remediation for "testmetest" npm Campaign Hijacks 42 GitHub Repositories to
Patches
- Patch cPanel & WHM and WP Squared for CVE-2026-41940 per vendor advisory
Immediate actions
- Isolate affected hosts and preserve commit, workflow and artifact metadata (author dates are forged and unreliable)
- Remove net-health-checker and pkg-runtime persistence, .napi_cache files and native addons BEFORE revoking stolen GitHub tokens to avoid triggering the wiper
- Remove unauthorized chore/ci-*, deps/upd-* branches, fake CodeQL scan-output artifacts, .github/init.js and AI/IDE hook files (.claude/settings.json, .gemini/settings.json, .cursor/mcp.json, .cursor/rules/setup.mdc, .vscode/tasks.json)
- Enumerate repository trees directly (GitHub code search and contents API miss multi-MB files)
- Block 43.228.157.68 and aiarmor.website at the perimeter and hunt CI logs for /tmp/.svc, ipscan and CVE-2026-41940
Workarounds
- Disabling npm install scripts is insufficient (binding.gyp command expansion and compiled addons); block the listed packages through a curation/registry proxy
Longer-term hardening
- Rotate exposed GitHub, npm, PyPI, RubyGems, cloud, SSH, Vault, Kubernetes and AI-provider credentials
- Rebuild compromised systems from trusted sources
- Restrict npm trusted-publishing/OIDC to specific workflows and branches and review Actions permissions
- Audit repositories for commits carrying skip-checks:true and unexpected workflow files
CVEs associated with "testmetest" npm Campaign Hijacks 42 GitHub Repositories to
Timeline of "testmetest" npm Campaign Hijacks 42 GitHub Repositories to
- Socket reports Miasma botnet loader in four @asyncapi npm packages; Shellpanel artifacts later link this testmetest cluster to infrastructure (stable-scripts-9965) from Socket's July investigation
- Socket report documents GitHub Actions abuse for cPanel exploitation using architecture-specific downloads and /tmp/.svc execution; JFrog links shellpanel artifacts to the same hijacked-owner clusters.
- Smoke-testing waves begin; 8 repositories under AsharaFernando18 are armed (2 leamasuero repositories armed 2026-07-30)
- Scripted arming batches across victim accounts with forged author dates
- data-pipeline-testmetest@2.0.1 published at 11:13:23 UTC
- First encrypted snapshot file appears in stable-scripts-9965 (18:19:21 UTC); SafeDep analysis published
- Last observed exfiltration snapshot committed to CementBeetleSteeple/stable-scripts-9965 at 16:31:03 UTC (27 files, 384,825 bytes in total; first snapshot 2026-10-22 18:19 UTC).
- stable-scripts-9965 holds 27 encrypted snapshot files totalling 384,825 bytes
- JFrog Security Research publishes 'Beyond testmetest: 42 Hijacked GitHub Repos'
- SafeDep documents newer execution variants
- GBHackers reports the campaign
Update history for TL-2026-4607
- 2026-10-28 — TrapDoor / testmetest Supply Chain Campaign: 42 GitHub Repositories Hijacked to Plant Startup-Hook Malware Targeting Claude, Gemini, Cursor and VS Code Users: What changed No change to severity (HIGH), exploitability (ACTIVE), status or attribution confidence; additive enrichment only. New indicators (5) Full exfiltration URL https://aiarmor.website/v1/api, two additional stable-scripts-9965 SHA-
Sources cited for "testmetest" npm Campaign Hijacks 42 GitHub Repositories to
- Malicious npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials and Spread Malware (GBHackers)
- Beyond testmetest: 42 Hijacked GitHub Repos (JFrog Security Research)
- Miasma Worm Returns to npm (JFrog Security Research)
- AsyncAPI Supply Chain Attack: Miasma botnet loader (Socket)
- CVE-2026-41940 (NVD)
- Critical cPanel authentication bypass (The Hacker News)
- CISA adds a flaw in WebPros cPanel to its KEV catalog (Security Affairs)
- CVE-2026-41940 Explained: cPanel & WHM Authentication Bypass (Picus Security)
Detection coverage for TL-2026-4607
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4607 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4607
3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.