testmetest: 42 armed repos run a payload when an agent opens them

01What happened

JFrog Security Research published its analysis of the testmetest campaign on October 26, 2026, written by Guy Korolevski and Yair Benamou. JFrog says it found 42 armed third-party GitHub repositories across 11 legitimate owners, and that its work followed SafeDep's October 22 report on the campaign's npm side. JFrog uses the name testmetest rather than Miasma, because it says the lineage to that worm family was never established.

02How it works

Startup hooks replace the package install script as the trigger. A Claude Code SessionStart hook in .claude/settings.json runs node .github/init.js, and equivalent triggers sit in .gemini/settings.json, .cursor/mcp.json, .cursor/rules/setup.mdc and .vscode/tasks.json, so opening the workspace in a supported tool is enough. The payload runs detached with output ignored, so the hook is never blocked. Newer npm packages hide the loader in a compiled addon.node that XORs an encrypted .napi_cache file with 0x96 and runs the result, skipping CI systems, containers, small VMs and debugged processes.

03Who is affected

Developers who open one of the armed repositories in Claude Code, Gemini CLI, Cursor or Visual Studio Code are exposed, as is anyone who installed one of the 25 package names JFrog inventoried. The owning accounts are legitimate, JFrog says, including the leamasuero account and the Crayon-Biz-LLP organization, so an armed repository does not look attacker-owned.

04What to do

Audit repositories you can reach for .github/init.js and for the agent and IDE hook files listed below, JFrog advises, and enumerate repository trees directly because the oversized wrappers defeat GitHub code search. Rotate GitHub, npm, cloud, SSH and AI provider credentials reachable from affected users or CI. Remove the net-health-checker and pkg-runtime persistence before revoking a GitHub token, because the worm ships a wiper that fires on revocation.

Questions people ask

Am I affected if I cloned a testmetest repository but never opened it?

Cloning alone does not fire the testmetest payload. JFrog reports that the hooks run when a supported tool loads the workspace: a Claude Code SessionStart hook, the Gemini CLI equivalent, a Cursor MCP entry or always-applied rule, or a Visual Studio Code folder-open task. A developer who cloned a repository and never opened it should still delete the copy and audit for those hook files first.

Which credentials should I rotate after a testmetest infection?

JFrog's remediation list covers GitHub, GitLab, npm, PyPI, RubyGems, cloud, SSH, Vault, Kubernetes and AI provider credentials. JFrog also tells defenders to remove the net-health-checker and pkg-runtime persistence before revoking a GitHub token, because the worm includes a token-revocation wiper. Installing a full-worm package version should be treated as a host compromise, so rebuild the machine rather than cleaning it.

Is testmetest the same thing as the Miasma worm?

JFrog deliberately avoids the Miasma name for this campaign. SafeDep described the payload as Miasma-family in its October 22 report without establishing lineage, so JFrog calls it the testmetest campaign instead. JFrog's own earlier research covered a Miasma variant that hijacked 96 package versions in the legitimate @redhat-cloud-services npm namespace in June 2026, a separate wave with a different delivery route.

How did the armed repositories avoid looking suspicious?

Forged history did much of the work. JFrog says that on September 28 the operator ran scripted arming batches that copied old commit messages and author dates and appended skip-checks:true, pushing many repositories within minutes. The wrappers also carry 12.9 to 13.7 MB of polymorphic code, which defeats GitHub code search and the contents API, so JFrog advises enumerating repository trees directly.

Sources 2 links, all fetched

1. 1research.jfrog.comJFrog Research
2. 2research.jfrog.comEarlier Miasma Wave