CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

testmetest npm worm

campaign · campaign:testmetest-npm-worm-2026-10

npm worm tracked as testmetest: SafeDep counts 19 packages from one operator between 2026-10-19 and 2026-10-27, whose newest builds start when an application imports the package, so installing with --ignore-scripts does not stop them; JFrog found 42 armed GitHub repositories of 11 legitimate owners; neither names an actor (SafeDep, 2026-10-27; JFrog Security Research, 2026-10-26).

Aliases: testmetest

Coverage
1
first 2026-10-29 → last 2026-10-29
Latest activity
2026-10-29
SafeDep and JFrog: the testmetest npm worm now runs on import, so --ignore-scripts does not stop it; 42 repos…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about testmetest npm worm, newest first. Check the date before acting on an older one.

  • Compare every lockfile and CI cache against the package list in SafeDep's post; on each host that installed or imported a listed package, disconnect it, remove persistence first and only then rotate the GitHub, npm, cloud and SSH credentials it could read, because the worm wipes the home directory when the stolen GitHub token is revoked.
    2026-10-29SafeDep and JFrog: the testmetest npm worm now runs…

Defender insights

What each entry about testmetest npm worm tells a defender to do, newest first.

2026-10-29NOTABLESafeDep and JFrog: the testmetest npm worm now runs on import, so --ignore-scripts does not stop it; 42 repos armed

Exposure · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

overlaps with

Story timeline

  1. 2026-10-29testmetest: an npm worm in the Miasma and Shai-Hulud family now starts when an application imports the package, so install with --ignore-scripts no longer protects, and JFrog finds 42 third-party GitHub repositories already armed with its publisher
    active-threatsSafeDep and JFrog: the testmetest npm worm now runs on import, so --ignore-scripts does not stop it; 42 repos armed

Hunting pivots

Affected products
GitHub ActionsGitLab CInpm
Tags
supply-chainwiper
ATT&CK techniques (7 across 7 tactics)

7 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessSupply Chain Compromise: Compromise Software Supply Chain
  • ExecutionCommand and Scripting Interpreter: JavaScript
  • StealthObfuscated Files or Information · Virtualization/Sandbox Evasion: System Checks
  • Credential AccessUnsecured Credentials: Credentials In Files
  • DiscoveryVirtualization/Sandbox Evasion: System Checks
  • ExfiltrationExfiltration Over Web Service: Exfiltration to Code Repository
  • ImpactData Destruction

Initial Access TA0001

T1195.002Supply Chain Compromise: Compromise Software Supply Chain×1

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts · ATT&CK page ↗

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts · ATT&CK page ↗

Discovery TA0007

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts · ATT&CK page ↗

Exfiltration TA0010

T1567.001Exfiltration Over Web Service: Exfiltration to Code Repository×1

Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.

Evidence: 2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts · ATT&CK page ↗

Impact TA0040

T1485Data Destruction×1

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Evidence: 2026-10-29/testmetest-npm-worm-runs-on-import-ignore-scripts · ATT&CK page ↗

Entries about testmetest npm worm (1)

2026-10-29 · view entry permalink →

NOTABLENATOB2

testmetest: an npm worm in the Miasma and Shai-Hulud family now starts when an application imports the package, so install with --ignore-scripts no longer protects, and JFrog finds 42 third-party GitHub repositories already armed with its publisher

SafeDep counts 19 npm packages from the same operator between 2026-10-19 and 2026-10-27, eight of them published through four npm accounts, that carry a worm sharing code with the June Miasma worm and adding the token-revocation wiper of Mini Shai-Hulud; SafeDep has not confirmed the lineage, and JFrog says its evidence does not establish that the original Miasma operators are responsible (SafeDep, 2026-10-27; JFrog Security Research, 2026-10-26). The install trigger has changed twice: first a command expansion in a binding.gyp file, with no install script; then a postinstall script that loads a native addon which decodes and starts the worm; and, since SafeDep's update of 27 October, an addon that runs when an application imports the package, so a hardening step that disables install scripts does not stop it (SafeDep, 2026-10-27).

The payload exits on CIS locales and in known analysis sandboxes. It steals SSH keys, registry and Git credentials, .env files, browser logins, AI-tool, cloud, Vault and Kubernetes secrets and GitHub Actions secrets read from runner memory (SafeDep, 2026-10-27). It exfiltrates by committing encrypted data, with the victim's encrypted GitHub token, to a new public repository in the victim's own account, injects a GitLab CI job that requests npm and PyPI OIDC tokens, adds its loader to the victim's npm packages and publishes new patch versions, republishes to PyPI and RubyGems, commits a fake CodeQL workflow and AI-agent configuration files that infect the host again, and copies itself over SSH to the hosts in known_hosts (SafeDep, 2026-10-27). A persistence service checks the stolen GitHub token every 45 seconds for 48 hours and on an authentication failure deletes the home directory (SafeDep, 2026-10-27). JFrog found 42 armed third-party GitHub repositories of 11 legitimate owners with hooks for AI coding assistants and IDEs, and says the payload blobs were large enough to evade GitHub's search and API paths (JFrog Security Research, 2026-10-26).

Any application that imports the package starts the worm.

The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the home directory when the victim revokes the stolen GitHub token.

SafeDep (living post, updated 2026-10-27) 2026-10-27

The payload blobs were large enough to evade the GitHub search and API paths normally used to find this kind of compromise.

JFrog Security Research 2026-10-26

SafeDep has not confirmed its exact lineage.

SafeDep (living post, updated 2026-10-27) 2026-10-27

Builds on: The compromised actions-cool GitHub Actions were re-enabled in September with malicious tags…

threat29 Oct 04:47Zmulti-sourceOpen finding →
Sources: SafeDep (living post, updated 2026-10-27) · JFrog Security Research

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • research.jfrog.com1 (50%)
  • safedep.io1 (50%)
All cited sources (2)