# Testmetest npm worm compromised 42 GitHub repositories across 11 owners

- URL: https://talkfuse.com/story/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/
- Published: 2026-10-26T22:29:01+00:00
- Updated: 2026-10-27T02:33:32+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
- Topics: Software

## Key points

- The worm armed 42 repositories across 11 GitHub owners.
- Large hidden payloads helped it evade searches and scanners.
- No downstream cPanel compromises were confirmed.

## Summary

Researchers found that an npm worm campaign initially thought to involve only the operator’s test accounts had secretly compromised 42 real GitHub repositories belonging to 11 owners. The discovery matters because the malware was designed to evade GitHub searches and automated security scanners, leaving established developers and organisations exposed.

The worm steals credentials, alters repositories and CI configurations, and spreads through npm packages. It planted hooks for tools including Claude, Gemini, Cursor and VS Code, alongside large, 12.9 to 13.7 MB payload wrappers that hid a CI-publishing payload. Researchers linked the campaign to an account hosting 17 repositories and reported attempted exploitation of cPanel, but did not confirm any resulting cPanel compromises.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.