Security researchers identified a sophisticated supply chain attack campaign involving 42 compromised GitHub repositories across 11 legitimate owners connected to the testmetest npm operation. The campaign evolved to use compiled native addons that decrypt hidden payloads at runtime, evading detection in CI environments through extensive anti-analysis checks. Attackers deployed polymorphic wrappers ranging from 12.9 to 13.7 MB that decode to identical publisher payloads, embedding execution hooks for AI coding assistants and IDEs. The operation included credential theft, repository hijacking, forged commit timelines, and automated malicious package publishing through GitHub Actions using npm trusted publishing. The infrastructure also links to shellpanel exploitation activities targeting cPanel systems. The campaign demonstrates advanced evasion techniques including environment detection for CI systems, containers, sandboxes, debuggers, and security tools before executing malicious code on developer workst...