# "testmetest" npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials, Abuse GitHub OIDC Publishing and Spread Malware

> A coordinated campaign armed 42 GitHub repositories belonging to 11 legitimate owners with credential-stealing payloads, AI/IDE execution hooks and CI-based npm publishing, spreading through malicious *-testmetest npm packages. Early releases executed code via command expansion in binding.gyp, bypassing install-script controls, and the payload can exchange GitHub OIDC tokens for npm publishing credentials and wipe on token revocation.

- **Published:** 2026-10-28T05:26:08Z
- **Last reviewed:** 2026-10-28T06:05:56.144Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4607
- **ID:** TL-2026-4607
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41940

## Description

JFrog Security Research (published 2026-10-26, researchers Guy Korolevski and Yair Benamou) documented a campaign that began as smoke-testing waves in July 2026 and escalated through September and October 2026. The operator account CementBeetleSteeple and a set of hijacked developer and organization accounts were used to plant weaponized files in 42 repositories across 11 legitimate owners, including AsharaFernando18, leamasuero, hakimrasdi, Crayon-Biz-LLP, ismahhaziq and ephronM. Attribution to the original Miasma operators is explicitly unproven; however, Shellpanel artifacts link the cluster to infrastructure in Socket's July 2026 investigation (stable-scripts-9965).

Initial execution occurs when a victim installs a malicious npm package (for example data-pipeline-testmetest@2.0.1, published 2026-10-21, or the @iobandamwer/* and @testsecuiitytestme/* scoped packages). Early releases ran index.js through command expansion in binding.gyp, so disabling npm lifecycle/install scripts does not prevent execution. Later packages ship compiled Node.js addons (addon.node, addon_win.node) that decrypt adjacent .napi_cache files with a single-byte XOR key 0x96 and launch the recovered JavaScript in detached processes. Payload wrappers use Caesar-style character transformations and AES-128-GCM and bootstrap Bun 1.2.18; ten distinct wrappers decrypt to the same publisher payload, so differences reflect encoding rather than new capability.

The payload harvests GitHub and npm tokens from the environment and files, then poisons repositories by planting .github/init.js (about 12.3-13.7 MB polymorphic wrappers) together with execution hooks for AI coding assistants and IDEs: .claude/settings.json, .gemini/settings.json, .cursor/mcp.json, .cursor/rules/setup.mdc and .vscode/tasks.json. Short-lived branches named chore/ci-<hex> carry a root-level ci.js publisher and GitHub Actions workflows, including fake CodeQL workflows that export environment variables to a one-day-retention scan-output artifact; JFrog recovered three distinct npm tokens across six repositories and 29 real npm access tokens captured in such artifacts. ci.js requests a GitHub Actions identity token (ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN) and exchanges it at the npm registry OIDC token-exchange endpoint (trusted-publishing flow with keyOwnerProof/publicKeyRequest) to publish weaponized package versions. Propagation branches follow deps/upd-<digits>; commits use the skip-checks:true trailer and forged author dates, so author timestamps are unreliable. Stolen tokens are dead-dropped via commits prefixed AutoSyncComplete: and snapshots are written as data/snap-<timestamp>-<n>.json (27 encrypted snapshots totalling 384,825 bytes by 2026-10-25 in stable-scripts-9965).

Persistence uses services named net-health-checker (systemd user services / LaunchAgents, ~/.local/bin/net-health-checker.sh, ~/.config/net-health-checker/) and pkg-runtime (~/.local/share/runtimes/sync.py, /var/tmp/.fontconfig_state). The worm contains token-revocation-triggered wiper logic, so remediation order matters: remove net-health-checker and pkg-runtime persistence before revoking stolen GitHub tokens. The compiled addon performs anti-analysis: it silently exits on CI environment variables, container markers in /proc/1/cgroup and /proc/1/cmdline, low-resource VMs (<=1.5 GB RAM or a single CPU) and debugger attachment (TracerPid, IsDebuggerPresent, CheckRemoteDebuggerPresent), and on Windows detects Wireshark, Fiddler, HTTP Debugger, Process Monitor, Process Explorer, x64dbg and OllyDbg.

A secondary 'shellpanel' component downloads a scanner binary (/tmp/.svc) from 43.228.157.68 and runs a mass internet scan with a CVE-2026-41940 exploit option against cPanel & WHM and WP Squared (CISA KEV-listed authentication bypass). JFrog confirmed no successful downstream compromise from this scanning. CVE-2026-41940 is an associated item and is not the vulnerability behind this supply-chain campaign. JFrog Xray and Curation flag all malicious package versions; SafeDep documented newer execution variants on 2026-10-27 (per GBHackers).

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1543.002 Systemd Service
- T1543.001 Launch Agent
- T1027.013 Encrypted/Encoded File
- T1036.004 Masquerade Task or Service
- T1497.001 System Checks
- T1622 Debugger Evasion
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1046 Network Service Discovery
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1584 Compromise Infrastructure
- T1595.002 Active Scanning
- T1546 Event Triggered Execution
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1105 Ingress Tool Transfer
- T1567.001 Exfiltration Over Web Service

## Sources

- [Malicious npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials and Spread Malware (GBHackers)](https://gbhackers.com/npm-target-github-repositories/)
- [Beyond testmetest: 42 Hijacked GitHub Repos (JFrog Security Research)](https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos/)
- [Miasma Worm Returns to npm (JFrog Security Research)](https://research.jfrog.com/post/miasma-worm-returns-to-npm/)
- [AsyncAPI Supply Chain Attack: Miasma botnet loader (Socket)](https://socket.dev/blog/asyncapi-supply-chain-attack)
- [CVE-2026-41940 (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-41940)
- [Critical cPanel authentication bypass (The Hacker News)](https://thehackernews.com/2026/04/critical-cpanel-authentication.html)
- [CISA adds a flaw in WebPros cPanel to its KEV catalog (Security Affairs)](https://securityaffairs.com/posts/u-s-cisa-adds-a-flaw-in-webpros-cpanel-to-its-known-exploited-vulnerabilities-catalog)
- [CVE-2026-41940 Explained: cPanel & WHM Authentication Bypass (Picus Security)](https://www.picussecurity.com/resource/blog/cve-2026-41940-explained-cpanel-whm-authentication-bypass-hit-1-5m-servers)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4607