testmetest npm worm campaign armed 42 GitHub repositories, JFrog reports

TLDR

• SafeDep reported testmetest npm packages carrying a worm with a wiper that triggers when a stolen token is revoked.¹
• SafeDep found no victims by 22 October; JFrog's 26 October report counts 42 armed repositories across 11 legitimate owners.¹²
• JFrog says the 42 repositories carry hooks for AI coding assistants and IDEs plus 12.9 to 13.7 MB payload blobs.²

SafeDep's 22 October report describes an operator testing a Miasma-family npm worm in public. Its malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token.¹ SafeDep says the worm shares code with the June 2026 Miasma "Phantom Gyp" worm and adds the token-revocation wiper from Mini Shai-Hulud, but it has not confirmed the lineage.¹ As of 22 October, SafeDep had found no compromised third-party packages or victims, and said all observed activity belonged to the operator's own test accounts.¹

JFrog's 26 October report reaches a different conclusion. It identified 42 armed third-party GitHub repositories across 11 legitimate owners, containing execution hooks for AI coding assistants and IDEs plus 12.9 to 13.7 MB polymorphic wrappers that decode to the same hidden CI-publisher payload.² JFrog says the operator "had already armed real repositories" belonging to established developers and organisations, and that the gap with SafeDep was not only a matter of timing: GitHub code search did not index the oversized blobs and the contents API could not return files of that size, so the repositories only surfaced when each one was enumerated through the Git trees and blobs APIs.² The hooks cover Claude, Gemini, Cursor MCP configuration and VS Code folder-open tasks.² JFrog dates real smoke-test activity on hijacked accounts to July, followed by scripted arming batches on 28 September that copied old commit messages and author dates from legitimate history.²

The two vendors' own counts differ and have moved since. The Register, relaying SafeDep, reports 18 packages linked to the operator between 19 and 25 October.³ SafeDep's page has since been updated: it now counts 19 packages between 19 and 27 October, names four npm accounts, says npm replaced the three packages from the iobandamwer account, which used a native-addon install trigger, with placeholders on 26 October, and says a package from a fourth account was still live on 27 October.¹ JFrog separately describes the native-addon camouflage, in which a compiled addon decrypts a file named .napi_cache and exits when it detects CI systems, containers, sandboxes or debuggers.²

JFrog also found shellpanel workflows that scan for cPanel and WHM systems vulnerable to CVE-2026-41940 within the same cluster of hijacked owners, overlapping with infrastructure Socket reported in July.² JFrog says this establishes operational linkage, not one proven execution chain from every npm infection to the exploitation, and says it found no evidence of successful downstream cPanel compromises.² The Register's article is based on the SafeDep and JFrog reports and quotes only those researchers, so it is not independent confirmation.³ JFrog advises removing the worm's persistence services before revoking the stolen GitHub token, because of the wiper.²

Why it matters: the SafeDep and JFrog reports differ on whether real victims exist, and both advise removing persistence before revoking stolen GitHub tokens because of the wiper.¹²