JFrog finds testmetest malware in 42 GitHub repositories
The security company says the repositories belong to 11 owners, extending the campaign beyond the operator-run test accounts seen in earlier research.
Loading… Բեռնվում է…
The security company says the repositories belong to 11 owners, extending the campaign beyond the operator-run test accounts seen in earlier research.
Supply-chain security company JFrog said the testmetest worm had armed 42 real GitHub repositories—online stores of project code—belonging to 11 owners. Its October 26 findings, detailed by The Register, identified affected accounts belonging to established developers and organizations, with hijackings dating back as early as July.
Earlier research had found a narrower picture. SafeDep, the software supply-chain security firm that first spotted the campaign, said that as of October 22 it had found no compromised third-party packages or victims. All activity it had observed belonged to the operator’s own test accounts. JFrog’s findings identified malicious code planted in other developers’ repositories, not just the operator’s tests.
JFrog said attackers planted execution hooks—instructions that cause tools to run code—for superintelligence (SI) coding assistants and other development tools. Alongside them were files measuring 12.9–13.7 MB that decoded hidden code for automated software publishing. The researchers said those files were large enough to evade the GitHub search tools and software-access interfaces normally used to find this kind of compromise.
The malware also uses a compiled software component to decrypt and launch separate malicious code. Before running it, the loader checks for automated build systems, isolated test environments and debugging tools. It stops silently when it detects them, reducing the chance that a security scanner will observe its behavior, the researchers said.
Researchers described the worm as self-replicating: it steals credentials, changes repositories and continuous-integration settings—the automated processes used to build and check software—and spreads through npm software packages. It also installs a wiper that deletes the victim’s home directory, where personal files and settings are stored, when the victim revokes the stolen GitHub access token. Revoking a token cancels that credential’s access.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
JFrog also linked the affected GitHub accounts to infrastructure associated with a server scanner previously documented by Socket. That earlier campaign abused GitHub Actions, a service for automating repository tasks, to exploit CVE-2026-41940 and steal server credentials.
CVE-2026-41940 is an older authentication-bypass vulnerability in cPanel and WHM: it lets attackers get past login checks. JFrog said it found attempts at internet-wide exploitation but did not confirm any resulting cPanel compromises. cPanel has already published patched versions for the vulnerability.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min