[carlospolop]

Blog URL

https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos

Blog Title

Beyond testmetest: 42 Hijacked GitHub Repositories and Hidden CI Publishers

Blog high summary

Documents the testmetest npm campaign’s expansion into 42 armed GitHub repositories across 11 owners. Install-time binding.gyp execution and native .node loaders decrypt payloads, evade CI and sandboxes, and trigger through AI/IDE hooks. The impact is host compromise, credential theft, repository poisoning, and package-registry propagation.

Hidden ci.js workflows abuse GitHub Actions OIDC/npm trusted publishing, inject postinstall, and exfiltrate NPM_TOKEN through fake CodeQL artifacts. Separate Shellpanel workflows scan random cPanel/WP Squared targets with ipscan --exploit CVE-2026-41940; they prove attempted exploitation, not confirmed downstream compromise.

PR changes

• src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-npm-supply-chain-abuse.md: Added a GYP expansion example, documented encrypted native-addon install execution and analysis gates, and clarified direct npm OIDC exchange and its publisher-identity constraint.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The native-addon mechanism and its analysis gates are source-supported and absent from the related base pages. The GYP example and OIDC exchange details add concrete constraints to mechanisms the book previously described only generally. The original duplicate footer banner was removed so the references section remains last.

Head: 18057d62c6870d84423c1640ad8974c4fd28f885

[carlospolop]

merge