Attackers Compromise 42 GitHub Repositories, Evading Search with Large Payloads

Attackers have compromised 42 third-party GitHub repositories by deploying malicious payloads designed to evade detection through an innovative size-based camouflage technique. The campaign leverages files too large for standard GitHub search and API paths to scan, according to a recent report by JFrog Security Research.

The victimised repositories contained execution hooks for popular AI coding assistants like Claude, Gemini, and Cursor, as well as integrated development environments (IDEs) such as VS Code. Crucially, the malware activates not during installation or execution, but simply when a developer opens the compromised repository in their development tool.

The malicious payloads were hidden within polymorphic wrappers, some as large as 13.7MB, which all decoded to a hidden CI-publisher payload. This technique allowed the attackers to bypass conventional detection methods. JFrog’s investigation also uncovered account hijacks, manipulated commit timelines, and exposed npm credentials.

A key innovation in the attack involves a compiled native addon that carries no payload itself. Instead, it decrypts a file named .napi_cache at runtime to reveal the true malicious content. This addon is engineered to avoid running in CI systems, containers, virtual machines, or under debuggers, and stands down on Windows if monitoring tools like Wireshark or Process Monitor are active.

Aman Mahapatra, chief strategy officer at Tribeca Softech, highlighted the significance of this new trigger mechanism. "For a decade, the supply chain threat model assumed malicious code ran when you installed or executed something," he noted. "This campaign plants a Claude Code SessionStart hook, Gemini settings, Cursor MCP configuration and rules, and VS Code folder-open tasks, so the payload runs when a developer simply opens the repository in their tool. .claude/settings.json is the new autorun.inf."

The attack campaign, linked to previously reported GitHub Actions exploitation of cPanel systems via "Shellpanel" artefacts, also involves attacker-controlled repositories acting as active encrypted data sinks. These repositories receive snapshot envelopes from compromised systems.

The broader operation leveraged an "npm worm" detected by JFrog’s scanners in October 2026, which involved "shai-hulud" packages in the npm ecosystem. Earlier, on October 22, SafeDep had documented the npm package side of this activity, decoding a package named [email protected] and initially describing its payload as "Miasma-family" without definitive lineage. SafeDep initially believed the "testmetest" campaign was merely a test by threat actors before discovering wider compromises.

Malicious "testmetest" releases used a binding.gyp command expansion to execute index.js during installation, even without a conventional install script. The loader would then collect GitHub and npm credentials, poison repositories, and compromise continuous integration (CI) configurations, propagating through package registries.

JFrog advises organisations to treat the installation of a full-worm version as a host compromise. Defensive recommendations include revoking and rotating all GitHub, GitLab, npm, PyPI, RubyGems, cloud, SSH, Vault, Kubernetes, and AI-provider credentials. Furthermore, organisations should audit all accessible repositories for specific malicious files like .github/init.js, .claude/settings.json, and .napi_cache.

Given the attackers’ evasion tactics, JFrog also recommended enumerating repository trees directly rather than relying on GitHub code search or the contents API. IT teams should delete unauthorised branches (e.g., chore/ci-*, deps/upd-*), disable malicious workflows, remove fake CodeQL artefacts, and block malicious infrastructure, including the IP address 43.228.157.68:80 at network controls.

Frank Dickson, principal analyst at Dickson Research, underscored the secondary risk posed by AI tools in this context. "The planted files are execution hooks for Claude, Gemini, Cursor, and VS Code. Opening a project in a supported tool can run the payload. A routine developer action becomes the detonator," he explained. While calling these hooks "features, not flaws," he stressed that "a feature that runs code when a folder opens deserves the same scrutiny as a build script."