JFrog Security Research reported on 26 October 2026 that 42 third-party GitHub repositories belonging to 11 legitimate owners had been armed in the testmetest npm campaign. The repositories contained execution hooks for AI coding assistants and development tools, including Claude, Gemini, Cursor and VS Code, alongside polymorphic wrapper files measuring 12.9 to 13.7 megabytes that all decoded to the same hidden CI-publisher payload.

How the hidden payload worked

The payloads stayed hidden because of their size. GitHub code search did not index the huge blobs and the contents API could not return files that large, so the affected files initially appeared empty. JFrog's first sweep found 26 repositories, but walking each repository through the Git trees and blobs APIs raised the total to 42.

What developers should check

The investigation also uncovered account hijacks, forged commit timelines, short-lived publishing branches and exposed npm credentials, while the campaign's attacker-owned repository acted as an active encrypted data sink.

A compiled native add-on carried no payload of its own and instead decrypted a file named .napi_cache at runtime to reveal the real one. The payload was designed to exchange GitHub OIDC tokens for npm publishing credentials, turning stolen access into fresh malicious releases that could then steal more access.

Before running, the loader checked for continuous-integration runners, containers, sandboxes and debuggers, exiting silently when it detected automated analysis.

Developers should audit assistant and editor configuration files, repository hooks and unexpected changes to package.json, composer.json or Makefiles, and rotate any credentials that may have been exposed. JFrog is careful about attribution: its evidence confirms shared tooling and a Shai-Hulud-descendant payload, but does not establish that the original Miasma operators are responsible.

Sources: JFrog Security Research and The Register.