JFrog: the testmetest npm worm has armed 42 GitHub repositories, with hooks for AI coding tools

JFrog Security Research says the testmetest campaign goes beyond npm: it found 42 armed GitHub repositories across 11 legitimate owners that hide an npm publisher, plus a new native addon that decrypts its payload at runtime and stays dormant in CI, sandboxes and analysis tools. The campaign spans 25 npm package names. JFrog tells readers to check whether they installed any testmetest or @iobandamwer packages and to remove them.

According to a summary of the research, the worm belongs to the Miasma family of npm worms. It adds payloads of about 13 MB in .github/init.js and hooks in .claude/settings.json (SessionStart) and in Gemini CLI, Cursor and VS Code configuration, so that opening an infected repository runs it. It is said to steal .env files, SSH, cloud and AI keys, and to wipe the home directory when a stolen token is revoked, so persistence should be removed before credentials are rotated.

Others who have written about it: Jamf Threat Labs describes a macOS variant whose trigger is hidden in binding.gyp as a silent fake node-gyp step, and a security feed lists three GitHub advisories (GHSA-7rwv-2p3x-mch4, GHSA-26g3-4jrv-x55w, GHSA-r5cq-2h3p-f6qf), some patched.