Worm Plants AI Coding Agent Hooks in 42 GitHub Repos

Key Takeaways

• The testmetest npm campaign weaponized 42 GitHub repositories belonging to 11 legitimate owners.
• Attackers planted execution hooks for Claude Code, Gemini, Cursor and VS Code that run when a project is opened.
• The payload steals GitHub, npm and cloud credentials and abuses trusted publishing to spread through npm.
• A built-in wiper is designed to fire if defenders revoke the stolen GitHub tokens.
• No confirmed downstream compromise has been reported yet.

Opening the Repo Is the Exploit

A new npm worm turned ordinary GitHub repositories into traps for AI-assisted developers. According to GBHackers, the testmetest campaign hid payloads behind session-start and folder-open hooks for popular AI coding tools, so a developer who simply opens a poisoned project can hand over their credentials.

What We Know

Researchers documented the activity on October 26, 2026, with JFrog Security Research publishing the main technical analysis and SafeDep tracking related packages on October 27. The operators hijacked 42 repositories across 11 owners, using forged commit histories, short-lived chore/ci branches and fake CodeQL workflows to hide oversized payload wrappers of roughly 13 MB that evaded initial searches.

Each weaponized repository carried a .github/init.js file alongside configuration for Claude Code, Gemini, Cursor and VS Code that triggers it on session start or workspace open. Packages in the campaign include data-pipeline-testmetest, event-emitter-testmetest and several scoped helper packages. heise online also covered the hijacked repositories, and JFrog found workflows that pull a second-stage binary and attempt cPanel exploitation. Victim identities and attribution to earlier Miasma operators remain unconfirmed.

What Happened

This is a software supply-chain worm that uses AI coding tools as its trigger. Instead of relying only on npm install scripts, the attackers placed instructions in the project configuration files that coding agents and AI-enabled editors honor automatically. Opening the folder is enough to run Node code with the developer's full permissions.

Once running, the payload harvests GitHub, npm, PyPI and cloud tokens, inspects trusted-publishing permissions and performs GitHub OIDC exchanges to mint npm publishing credentials, letting it push new poisoned versions. Persistence services named net-health-checker and pkg-runtime watch for token revocation and trigger a wiper, which punishes the standard incident response step. The AI angle is the execution surface: agent hooks are designed to run without a prompt, and developers rarely review them.

Why It Matters

AI coding tools now treat repository configuration as trusted code. That turns every cloned repository into a potential launcher and lets a worm move from one developer machine to many publishing pipelines. Stolen npm and GitHub tokens give attackers a path into downstream software used by organizations that never touched the original repository.

The campaign continues a pattern of attackers targeting AI developer tooling, seen earlier when infostealers raided AI coding agents for tokens and MCP configs. The wiper adds operational risk: teams must remove persistence before rotating secrets, or risk data loss during cleanup.

PointGuard AI Perspective

Coding agents and their hook files are now part of the attack surface. PointGuard AI Agentic Endpoint Security discovers AI coding tools on developer machines, flags auto-run hooks and risky configuration, and can block agents from executing unapproved commands when a project opens.

PointGuard AI Supply Chain Security builds an AI bill of materials across repositories and packages, so teams can quickly find any project that pulled a testmetest package or carries planted agent configuration. Treating agent configuration as code, with review and inventory, is how organizations keep AI-assisted development fast without letting a cloned repo run the attacker's playbook.

Incident Scorecard Details

Total AISSI Score: 7.0/10

Criticality: 7, Developer machines hold source code, signing material and publishing tokens for downstream software. AISSI weighting: 25%

Propagation: 8, A self-spreading worm that republishes through npm and plants hooks across repositories. AISSI weighting: 20%

Exploitability: 7, Active campaign with real hijacked repositories and published malicious packages. AISSI weighting: 15%

Supply Chain: 9, Abuses open-source packages, GitHub repositories and AI tool configuration trusted by developers. AISSI weighting: 15%

Business Impact: 5, Real repositories compromised, but no confirmed downstream breach reported yet. AISSI weighting: 25%

Sources

Third-Party Sources

• GBHackers: Malicious npm Campaign Hijacks 42 GitHub Repositories
• heise online: Attackers hijack 42 GitHub repositories in npm worm campaign testmetest

PointGuard AI Sources

• PointGuard AI Agentic Endpoint Security
• PointGuard AI Supply Chain Security
• PointGuard AI Incident Tracker: Infostealers Raid AI Coding Agents for Tokens and MCP Configs