Hackers Hijack 42 GitHub Repositories to Plant Malware Traps for Claude, Gemini, and Cursor Users

Hackers have quietly planted malware in 42 real GitHub repositories. The traps fire when a developer opens a project with Claude, Gemini, Cursor, or VS Code. The repositories belong to 11 legitimate owners, including individual developers, students, and one company.

The hidden code sits in a file named .github/init.js, and it is huge, between 12.9 MB and 13.7 MB. Small settings files for each tool call this script when a session starts or a folder opens.

Developers already worry about GitHub comment prompt injection that tricks AI agents, but this case needs no clever prompt. It simply abuses the startup hooks that the tools trust.

Researchers at JFrog Security Research identified the armed repositories while digging into an npm worm they track as the “testmetest” campaign.

Another firm, SafeDep, had first described the npm side on October 22 and reported no confirmed victims. JFrog’s look at the GitHub side showed that real repositories had already been armed.

Hackers Hijack 42 GitHub Repositories

The payload is a rebuild of a hidden CI publisher called ci.js. A CI publisher is a script that runs inside GitHub Actions and pushes new packages to npm.

JFrog says the operator wanted to turn stolen GitHub and npm access into fresh malicious releases, which then feed more stolen access back into the loop. The same TrapDoor supply chain campaign also aimed at AI coding assistants, so this trick is not entirely new.

In each victim repository, the hook files wait for a trigger. The Claude settings file, for example, runs node .github/init.js || bun .github/init.js at session start.

Matching triggers were placed for Gemini, Cursor’s MCP configuration, and VS Code folder-open tasks. Some projects also had package.json, composer.json, or Makefile changes. In plain terms, a normal habit like opening a workspace could run the payload.

The files stayed hidden because of their size. GitHub code search did not index the huge blobs, and the contents API could not return them.

JFrog’s first sweep found 26 repositories, and the files looked empty. Checking the repository trees directly raised the total to 42. The Register also covered the findings.

All 10 wrapper variants decode to the same payload, so the size differences do not change what it does. The attacker also faked history. On September 28, scripted batches copied old commit messages and dates from real history and added skip-checks:true. That made the activity look much older than it was.

Stolen Accounts, Native Addons and cPanel Links

JFrog traced several hijacked identities. One account, leamasuero, belonged to a developer with real work history from 2014 to 2022.

By July 2026 it was used for testing, and on September 28 the attacker renamed repositories and armed 13 of them in two minutes. In the company account, Crayon-Biz-LLP, commits came from at least two members, which suggests several stolen credentials.

The npm side also changed tactics. Three packages carry a compiled native addon and an encrypted file called .napi_cache. The addon decrypts it with the XOR key 0x96, drops a script into a temporary folder, and runs it in the background.

It stays asleep on CI systems, containers, small virtual machines, and debuggers, so automated scanners miss it. The Windows build also checks for tools such as Wireshark, Fiddler, and x64dbg. This is the kind of trusted-looking bait seen in the fake AI tool campaign that targets developers.

JFrog also found scanner workflows in the same hijacked accounts. They download a tool to /tmp/.svc and scan for cPanel and WHM systems vulnerable to CVE-2026-41940, an authentication bypass.

JFrog found no proof that any cPanel server was actually breached. The link is operational, and not one proven chain from every npm infection to the exploit.

Defenders should remove the malicious package versions and rebuild affected systems from trusted sources. They should rotate GitHub, npm, cloud, SSH, and AI-provider credentials, and check every reachable repository for the hook files above.

Teams should read repository trees directly instead of relying on search. They should also watch for HalluSquatting poisoning AI assistants, since AI tools can be steered toward fake resources.

One order matters: remove the net-health-checker and pkg-runtime persistence before revoking the stolen GitHub token, because the worm contains a token-revocation wiper.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hijack 42 GitHub Repositories to Plant Malware Traps for Claude, Gemini, and Cursor Users appeared first on Cyber Security News.