Threat
Worm armed 42 GitHub repos by hiding a payload too big to fail
First reported theregister.com
Page published
Earliest dated coverage: 26 Oct 2026 · First observed: 26 Oct 2026 · Latest dated coverage: 26 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The testmetest campaign shows how compromised repositories can target AI coding-assistant execution hooks with credential-stealing and destructive malware while oversized payloads undermine routine scanning.
JFrog reports that the testmetest npm worm armed 42 GitHub repositories across 11 owners, planting execution hooks for AI coding assistants and development tools. The Miasma-family malware self-replicates, steals credentials, and includes a home-directory wiper triggered by revocation of stolen GitHub tokens. Payload blobs measuring 12.9–13.7 MB helped evade GitHub code search and routine discovery.