Security protections on GitHub were not breached but individual customer protections were, and autonomous coding agents played a role.

The cybersecurity community is confronting a sophisticated, multi-vector supply chain campaign that underscores a radical evolution in how malicious actors compromise developer environments. Recent findings from JFrog Security Research have revealed that attackers successfully hijacked 42 third-party GitHub repositories, deploying advanced payloads designed to evade conventional security tooling. While GitHub’s core infrastructure remained entirely uncompromised, the individual security postures of multiple target organizations were breached through a combination of stolen credentials, innovative file-cloaking techniques, and the malicious weaponization of execution hooks native to modern AI coding assistants and integrated development environments (IDEs).

Unlike traditional supply chain attacks that rely exclusively on install-time execution scripts or malicious packages published to registries like npm, this campaign—initially linked to the Miasma threat cluster and the "testmetest" npm packages—targets developers at the point of interaction. By embedding configuration files and execution hooks for tools such as Claude Code, Google Gemini, Cursor, and Visual Studio Code, the threat actors have shifted the attack vector from running build commands to the mere act of opening a project folder. Industry experts have drawn stark parallels, noting that configuration files like .claude/settings.json are rapidly becoming the modern equivalent of the classic autorun.inf vulnerability.

The Chronology and Evolution of the Attack

The timeline of this sophisticated operation stretches back to mid-October, highlighting a rapid escalation in attacker capabilities and distribution methods. On October 21, automated security scanners operated by JFrog flagged anomalous packages exhibiting malicious behavior within the npm ecosystem. Shortly thereafter, on October 22, security firm SafeDep published an in-depth analysis of a specific package, [email protected], classifying the payload as a variant of the Miasma family, though its exact lineage remained ambiguous at the time.

Initially, security researchers hypothesized that these packages were merely low-level tests or benign experiments conducted by a curious threat actor. However, ongoing investigations revealed a far more sinister reality. The packages were not isolated tests; they served as the initial dissemination vector for a full-scale npm worm. By exploiting installation mechanics through binding.gyp command expansions, the malicious releases executed index.js scripts even when the packages did not explicitly declare conventional installation scripts.

The loader within these packages utilized a per-build Caesar transformation on a character-code array, successfully decrypting an AES-128-GCM stage. This stage subsequently located or downloaded the Bun 1.2.18 runtime, piping the decrypted payload directly to bun run – or writing it to a temporary .b-* directory before executing and erasing it. Once established on a developer’s machine, the full npm payload systematically harvested credentials, poisoned local repositories, and manipulated CI/CD configurations, ultimately propagating further malicious releases through package registries and hijacking connected GitHub repositories.

Technical Innovations: Evasion and Camouflage

The campaign stands out for its high degree of technical sophistication, specifically regarding how the threat actors managed to bypass automated security checks and manual code reviews. A primary hurdle for attackers is ensuring their payloads persist within repositories without being flagged by GitHub Code Search or internal repository scanners. To counter this, the threat actors deployed payload blobs as large as 13.7 megabytes. These massive wrappers successfully exceeded the indexing limitations of GitHub code search and the contents API, causing early automated analysis tools to overlook the contents or erroneously report that the files were empty.

Furthermore, the investigation uncovered a novel camouflage technique: a compiled native addon that contains zero payload of its own. Instead, this addon acts as a dormant shell, decrypting a hidden file named .napi_cache at runtime to reveal the actual malicious payload. This native addon is engineered with aggressive anti-analysis checks; it flatly refuses to execute within continuous integration (CI) pipelines, containerized environments, small virtual machines, or under active debuggers. On Windows systems, the addon checks for the presence of monitoring tools such as Wireshark or Process Monitor, standing down immediately if analysis tools are detected. Consequently, automated cloud-based security scanners perceive only a benign placeholder, while a developer’s local workstation receives the active payload.

Once a developer clones or opens the compromised repository, the embedded execution hooks—spanning multiple AI coding assistants and IDE environments—automatically detonate the payload. Because these AI integrations and task runners are designed to automate workflows and enhance productivity, their native capabilities to execute code upon opening a project folder were effectively turned against the user. The stolen credentials gathered during this phase typically included GitHub and npm tokens, cloud provider keys, SSH certificates, and AI-provider credentials, providing the attackers with lateral movement across third-party networks and repositories.

Industry Reactions and Expert Analysis

The implications of this campaign have sent ripples through the cybersecurity industry, prompting urgent reassessments of how software development organizations secure their local workstations and integrate third-party AI assistants. Aman Mahapatra, chief strategy officer at Tribeca Softech, emphasized that the campaign fundamentally alters the established threat model for software supply chains.

"For a decade, the supply chain threat model assumed malicious code ran when you installed or executed something," Mahapatra observed. "This campaign plants a Claude Code SessionStart hook, Gemini settings, Cursor MCP configuration and rules, and VS Code folder-open tasks, so the payload runs when a developer simply opens the repository in their tool. .claude/settings.json is the new autorun.inf."

Mahapatra highlighted the strategic shift in attacker methodology, noting that threat actors have successfully transitioned the trigger mechanism from active execution to passive interaction. By designing malware that actively evades sandboxes and weaponizing features introduced by the industry to improve developer efficiency, attackers have forced a paradigm shift. "Supply chain defense built around install-time scanning is now guarding the wrong moment," he added, expressing particular concern over the file-size padding technique designed to blind automated detection systems.

Frank Dickson, principal analyst at Dickson Research, shared similar insights, praising the meticulous engineering behind the attacker’s native addon and sandbox-evasion protocols. Dickson noted that while the inclusion of AI execution hooks introduces a severe risk element, it functions as a secondary exposure vector that compounds the damage only after active credentials have been compromised.

"The planted files are execution hooks for Claude, Gemini, Cursor, and VS Code. Opening a project in a supported tool can run the payload. A routine developer action becomes the detonator," Dickson explained. "A developer’s laptop holds the keys to the kingdom: GitHub tokens, npm tokens, cloud keys, and AI provider credentials. Attackers have found a new way to ask for them. To be fair, these hooks are features, not flaws. The root cause here is stolen credentials, not the AI tools. Still, a feature that runs code when a folder opens deserves the same scrutiny as a build script."

Comprehensive Defensive Recommendations

In response to the severity of the campaign, JFrog Security Research has issued a comprehensive set of remediation and defensive guidelines for Chief Information Security Officers (CISOs) and security engineering teams. Given the depth of credential theft associated with the full-worm version of the payload, organizations are strongly advised to treat any confirmed installation as a complete host compromise.

Immediate mitigation steps include the wholesale revocation and rotation of a wide array of credentials, including GitHub, GitLab, npm, PyPI, RubyGems, cloud infrastructure keys, SSH keys, Vault tokens, Kubernetes secrets, and AI-provider API keys. Organizations must also conduct thorough audits of all repositories accessible to affected identities, specifically searching for unauthorized configuration files and execution hooks such as .github/init.js, .claude/settings.json, .gemini/settings.json, .cursor/mcp.json, .cursor/rules/setup.mdc, and .vscode/tasks.json, alongside unexpected composer.json files, Makefile execution hooks, and commits containing skip-checks:true directives.

Because standard automated tools may fail to index oversized files, security teams are advised to enumerate repository trees directly rather than relying solely on GitHub code search or the contents API. Furthermore, IT administrators should immediately delete unauthorized branches (such aschore/ci- and deps/upd-), disable unauthorized workflows, and remove fraudulent CodeQL artifacts named scan-output.

Network-level defenses should be updated to block associated malicious infrastructure—specifically IP address 43.228.157.68 on port 80—and security teams must hunt GitHub Actions logs and runners for suspicious indicators, including references to /tmp/.svc, network scanning activities, architecture-specific /api/dl/ requests, unusually broad scans originating from hosted or self-hosted runners, and the presence of .napi.cache files.

As the adoption of AI-driven coding assistants continues to accelerate across the software development lifecycle, the intersection of developer productivity tools and security governance will remain a critical battleground. This latest campaign demonstrates that as defensive mechanisms mature, threat actors will increasingly target the foundational trust placed in developer workflows, IDE integrations, and automated assistants, necessitating a holistic approach to endpoint and supply chain security.