What happened
JFrog linked 42 armed third-party GitHub repositories across 11 legitimate owners to the testmetest npm campaign. Malicious npm releases use a binding.gyp command expansion to execute code during install, decrypting a payload that steals GitHub and npm credentials, poisons repositories and CI configuration, and plants execution hooks for AI coding assistants and IDEs — injecting SessionStart hooks into Claude Code settings and tasks into VS Code. The GitHub side carried 12.9-13.7 MB polymorphic wrappers and hidden publishers designed to run through GitHub Actions to produce further malicious releases. A later delivery switched to a precompiled native addon (addon.node) that decrypts a .napi_cache dotfile at runtime to run the real payload, with anti-CI/container checks.
Why it matters
This is a supply-chain worm aimed squarely at the AI coding-agent config/hook surface (SessionStart hooks, VS Code tasks, CI config), converting a normal package/repo install into credential theft and self-propagation through the registries developers already trust. It exposes the agent-execution attack class and active campaign signal that the CVE seed does not carry.
Attack vector
Malicious npm package install (binding.gyp command expansion) or use of a hijacked GitHub repo; payload steals GitHub/npm credentials and injects SessionStart hooks into AI coding assistant config, then propagates to further repos/packages.
Affected systems
npm ecosystem (testmetest-family packages, e.g. event-bus-lite-testmetest, path-stream-utils-testmetest, @iobandamwer/* helper packages) and hijacked GitHub repositories; Claude Code / VS Code / AI coding agent config surfaces.
Mitigation
Pin and vet dependencies, audit SessionStart hooks and VS Code tasks in repositories you clone, validate npm trusted-publishing tokens, monitor GitHub Actions for short-lived unknown publisher workflows, and treat testmetest-family package/owner names as indicators.