{"id":10179,"date":"2026-10-28T02:58:27","date_gmt":"2026-10-28T02:58:27","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10179"},"modified":"2026-10-28T02:58:27","modified_gmt":"2026-10-28T02:58:27","slug":"attackers-compromised-42-github-repositories-by-using-files-too-large-to-be-searched","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10179","title":{"rendered":"Attackers compromised 42 GitHub repositories by using files too large to be searched"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A security research firm reported Monday that it had identified breaches of 42 third-party GitHub repositories in which attackers had deployed payload blobs large enough \u201cto evade the GitHub search and API paths normally used to find this kind of compromise.\u201d<\/p>\n

The report<\/a> from JFrog Security Research said the victimized repositories contained execution hooks for AI coding assistants and IDEs, along with polymorphic wrappers as large as 13.7MB that \u201call decoded to the same hidden CI-publisher payload. The campaign\u2019s attacker-owned repository also operates as an active encrypted data sink, receiving snapshot envelopes, and the attack leveraged a new camouflage: a compiled native addon that contains no payload of its own, and instead decrypts a file named .napi_cache<\/em> at runtime to reveal the real one.\u201d<\/p>\n

JFrog said that the investigation also uncovered account hijacks, forged commit timelines, short-lived publishing branches and exposed npm credentials. Shellpanel artifacts in the same hijacked owner cluster link this GitHub victim infrastructure to previously reported GitHub Actions exploitation of internet-facing cPanel systems.<\/p>\n

\u201cDuring October 21 our scanners alerted us about shai-hulud packages found in the npm ecosystem,\u201d JFrog wrote. \u201cSafeDep\u2019s October 22 analysis<\/a> first documented the npm\/package side of this activity and decoded event-bus-lite-testmetest@0.0.1<\/em>. SafeDep described the payload as Miasma-family while explicitly noting uncertainty about its lineage.\u201d<\/p>\n

SafeDep had originally thought that the packages in the campaign it had discovered, dubbed testmetest, were merely a test by the threat actor, but this week discovered the compromises of existing repos with malicious content.<\/p>\n

The JFrog post also focused on the npm chain implications.\u00a0<\/p>\n

\u201cThe npm chain provides the link into the broader operation. Malicious testmetest releases used a binding.gyp<\/em> command expansion to execute index.js<\/em> during installation, even though the packages did not declare a conventional install script,\u201d the post said. \u201cThe loader applied a per-build Caesar transformation to a character-code array, decrypted an AES-128-GCM stage and located or downloaded Bun 1.2.18. Depending on the build, the decrypted payload was piped to bun run –<\/em> or written to a temporary .b-*directory and removed after execution. The full npm payload collected credentials, poisoned repositories and CI configuration, and propagated through package registries.\u201d<\/p>\n

Those attacker-controlled repositories served as sources of cover projects for matching npm packages, JFrog said.\u00a0<\/p>\n

\u201cMalicious releases delivered the npm worm, which stole GitHub and npm credentials that could provide access to third-party repositories. Within hijacked repositories, the campaign left smoke-test placeholders or armed payloads,\u201d the researchers wrote. \u201cDecoding the armed ci.js<\/em> files exposed publishers designed to run through GitHub Actions and use npm tokens or trusted publishing to produce further malicious testmetest releases, feeding package delivery back into repository compromise.\u201d<\/p>\n

Defensive recommendations<\/h2>\n

JFrog\u2019s post recommended a variety of defensive tactics for detection and mitigation of these attacks, including that CISOs \u201cshould treat installation of a full-worm version as a host compromise.\u201d It also suggested that users should revoke and rotate all GitHub, GitLab, npm, PyPI, RubyGems, cloud, SSH, Vault, Kubernetes and AI-provider credentials, as well as auditing \u201call repositories accessible to affected identities for .github\/init.js<\/em>, .claude\/settings.json<\/em>, .gemini\/settings.<\/em>json, .cursor\/mcp.json<\/em>, .cursor\/rules\/setup.mdc<\/em>, .vscode\/tasks.json<\/em>, unexpected composer.json<\/em> or Makefile execution hooks, and skip-checks:true<\/em> commits.\u201d<\/p>\n

JFrog also suggested that companies enumerate repository trees directly and that IT should not rely on GitHub code search or the contents API, because of the wrapper size issue.<\/p>\n

\u201cDelete unauthorized chore\/ci-*<\/em> and deps\/upd-*<\/em> branches, disable malicious workflows and remove fake CodeQL<\/em> artifacts named scan-output<\/em>. Block hxxp[:]\/\/43[.]228[.]157[.]68:80<\/em>, \u00a0<\/em>and related malicious infrastructure at network controls\u201d and \u201chunt GitHub Actions logs and runners for \/tmp\/.svc<\/em>, ipscan, CVE-2026-41940, architecture-specific \/api\/dl\/<\/em> requests and unusually broad scans from hosted or self-hosted runners,\u201d JFrog suggested. And. Of course, look for .napi.cache<\/em>.<\/p>\n

High priority target<\/h2>\n

The popularity of GitHub repositories<\/a> is likely going to continue to make them a high-priority target for attackers<\/a>.\u00a0<\/p>\n

Aman Mahapatra<\/a>, chief strategy officer for New York City-based technology consulting firm Tribeca Softech, said the particulars of this attack will likely predict the path of new AI-focused attacks for the immediate future.<\/p>\n

\u201cFor a decade, the supply chain threat model assumed malicious code ran when you installed or executed something,\u201d he said. \u201cThis campaign plants a Claude Code SessionStart hook, Gemini settings, Cursor MCP configuration and rules, and VS Code folder-open tasks, so the payload runs when a developer simply opens the repository in their tool. .claude\/settings.json<\/em> is the new autorun.inf<\/em>.\u201d<\/p>\n

\u201cAttackers have moved the trigger from running code to opening a folder, built malware that hides from sandboxes by design, and turned the industry\u2019s last fix into the next target,\u201d Mahapatra said. \u201cSupply chain defense built around install-time scanning is now guarding the wrong moment.\u201d<\/p>\n

He said he was especially worried about the file size tactic that the attackers leveraged.<\/p>\n

\u201cThe 13MB wrappers add a cruder trick. They exceed what GitHub code search indexes and what the contents API returns, which is why early analysis found the hooks and concluded the payload files were empty,\u201d Mahapatra said. \u201cThe attacker read the documentation for your detection tooling and padded the file past its limits.\u201d<\/p>\n

Frank Dickson<\/a>, principal analyst at Dickson Research, said he was also impressed with the attacker\u2019s use of a native addon.<\/p>\n

\u201cIt carries no payload of its own and refuses to run inside CI systems, containers, small virtual machines, or under a debugger,\u201d he said. \u201cOn Windows, it also stands down if Wireshark or Process Monitor is running. The scanners see a placeholder but the developer\u2019s laptop gets the real thing.\u201d<\/p>\n

Dickson said the AI risk element is there, but it\u2019s a secondary exposure that is only an issue once the attackers steal active credentials. Still, it is worse due to agentic efforts.\u00a0<\/p>\n

\u201cThe planted files are execution hooks for Claude, Gemini, Cursor, and VS Code. Opening a project in a supported tool can run the payload. A routine developer action becomes the detonator. A developer\u2019s laptop holds the keys to the kingdom if you will: GitHub tokens, npm tokens, cloud keys, and AI provider credentials. Attackers have found a new way to ask for them,\u201d Dickson said. \u201cTo be fair, these hooks are features, not flaws. The root cause here is stolen credentials, not the AI tools. Still, a feature that runs code when a folder opens deserves the same scrutiny as a build script.\u201d<\/p>\n

This article originally appeared on InfoWorld<\/a>.<\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A security research firm reported Monday that it had identified breaches of 42 third-party GitHub repositories in which attackers had deployed payload blobs large enough \u201cto evade the GitHub search and API paths normally used to find this kind of compromise.\u201d The report from JFrog Security Research said the victimized repositories contained execution hooks for […]<\/p>\n","protected":false},"author":0,"featured_media":10180,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10179","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10179"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10179"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10179\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10180"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10179"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10179"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10179"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}