Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher

Summary by Cyber Security News26 Oct 2026, 01:00 CET

About this summary. This is a short excerpt from the description that JFrog Security Research published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos/

JFrog Security Research has identified **42 armed third-party GitHub repositories across 11 legitimate owners** connected to the `testmetest` npm campaign. The repositories contain execution hooks for AI coding assistants and IDEs, plus 12.9 to 13.7 MB polymorphic wrappers that all decode to the same hidden CI-publisher payload. The campaign’s attacker-owned repository also operates as an active encrypted data sink, receiving snapshot envelopes.

Read the full article at JFrog Security Research →

Source attribution: headline and facts are from JFrog Security Research (research.jfrog.com). Summary method: excerpt of the source description. See our source attribution policy.