Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher

Security researchers identified a sophisticated supply chain attack campaign involving 42 compromised GitHub repositories across 11 legitimate owners connected to the testmetest npm operation. The campaign evolved to use compiled native addons that decrypt hidden payloads at runtime, evading detection in CI environments through extensive anti-analysis checks. Attackers deployed polymorphic wrappers ranging from 12.9 to 13.7 MB that decode to identical publisher payloads, embedding execution hooks for AI coding assistants and IDEs. The operation included credential theft, repository hijacking, forged commit timelines, and automated malicious package publishing through GitHub Actions using npm trusted publishing. The infrastructure also links to shellpanel exploitation activities targeting cPanel systems. The campaign demonstrates advanced evasion techniques including environment detection for CI systems, containers, sandboxes, debuggers, and security tools before executing malicious code on developer workst...

• Shai-Hulud Trinitite Hits @7nohe/openapi-react-query-codegenMalware2026-08-31
• Tracking Shai-Hulud: Inside the ChainDrop NPM WormMalware2026-08-12
• Token Jacking: Cybercriminals Could Be Stealing Your AI ResourcesMalware2026-08-06
• Major Shai Hulud campaign strikes npm again, affecting keyv and 400+ packagesMalware2026-08-06
• Intercom-client@7.0.4 Harvesting Github CredentialsCampaign2026-07-24