The attack altered trusted repositories so that an assistant or developer workflow could encounter executable configuration where only project data was expected. JFrog reports large JavaScript artifacts hidden from normal code search and native helper components used to unpack further functionality. A workflow invoking those hooks would confer the developer…
Inspect the ClaimsCase · DiggingBeagle record
Forty-two hijacked repositories carried testmetest agent hooks
JFrog reports 42 modified GitHub repositories across 11 owners, with agent configuration hooks and concealed JavaScript payloads. Repository compromise is supported; execution or exfiltration from every repository is not established.
Agent package lifecycle scripts can persistently rewrite tool and memory authorityAgent-enabled software supply-chain attack
Scope
The report enumerates modified repositories and payload constructions, not a confirmed victim count. Related GitHub Actions publishing and possible exploit-testing infrastructure are investigative leads, not proof that one operator controlled every adjacent artifact.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Enrich update: CLM-ENRICH-20261027-32 cites SRC-2026-CP21-TESTMETEST-AGENT-HOOKS at JFrog October 26 report, A native addon hides the payload in .napi_cache and It only runs where nobody is watching. New evidence concerns the bounded reported mechanism, prerequisite or outcome; setting production; exploit status observed_live; remediation status mitigation_available. No independently comparable impact scale, affected production population or universal exploit success measure was established, so the impact band remains null. Original Claims remain individually attributable and any observed incident or simulated result is distinguished in the narrative.
Assessed Oct 27, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENRICH-20261027-32 · JFrog: Beyond testmetest, 42 hijacked repositories and agent configuration hooks
At a glance
This is a repository-tampering and agent-integration attack family. Its decisive boundary is whether configuration from a compromised checkout obtains runner authority.
Read the implicationsThe report enumerates modified repositories and payload constructions, not a confirmed victim count. Related GitHub Actions publishing and possible exploit-testing infrastructure are investigative leads, not proof that one operator controlled every adjacent artifact.
Limits and uncertaintyFull account
The attack altered trusted repositories so that an assistant or developer workflow could encounter executable configuration where only project data was expected. JFrog reports large JavaScript artifacts hidden from normal code search and native helper components used to unpack further functionality. A workflow invoking those hooks would confer the developer or runner permissions to attacker-controlled code.
JFrog identifies 42 armed GitHub repositories belonging to 11 legitimate owners and agent-related hook locations under Claude, Gemini, Cursor and VS Code configuration. It describes payload-hiding and native-module loader behavior but not 42 verified executions. The report enumerates modified repositories and payload constructions, not a confirmed victim count. Related GitHub Actions publishing and possible exploit-testing infrastructure are investigative leads, not proof that one operator controlled every adjacent artifact.
Treat changes to assistant instructions, IDE hooks, lifecycle scripts and CI configurations as executable supply-chain changes, and compare the complete Git object tree rather than relying on indexed code search alone. This is a repository-tampering and agent-integration attack family. Its decisive boundary is whether configuration from a compromised checkout obtains runner authority. Primary evidence.
Additional evidence and trust boundary
This operation combined two separate trust boundaries. Agent configuration hooks in a hijacked repository could run with developer workflow authority, while native npm addons installed additional code that deliberately hid from typical analysis environments. Incident responders should compare full Git trees, lockfile-resolved package versions and local hidden loader artifacts; a repository count does not establish how many machines actually executed the code. The infrastructure link to shellpanel activity is an investigative association, not complete actor attribution. Supporting record.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 26, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261027-32JFrog describes native-addon carriers that decrypt a separate .napi_cache file with XOR 0x96 and suppress execution in CI, small virtual machines, containers or debugging environments before launching a detached Node process.supported
Basis: reported finding
- supportsJFrog: Beyond testmetest, 42 hijacked repositories and agent configuration hooksprimary disclosure
JFrog October 26 report, A native addon hides the payload in .napi_cache and It only runs where nobody is watching
CLM-CP21-TESTMETEST-AGENT-HOOKS-1JFrog identifies 42 armed GitHub repositories belonging to 11 legitimate owners and agent-related hook locations under Claude, Gemini, Cursor and VS Code configuration. It describes payload-hiding and native-module loader behavior but not 42 verified executions.supported
Basis: reported finding
- supportsJFrog: Beyond testmetest, 42 hijacked repositories and agent configuration hooksprimary disclosure
Overview; infected repository inventory; agent hooks and payload extraction analysis
Implications
This is a repository-tampering and agent-integration attack family. Its decisive boundary is whether configuration from a compromised checkout obtains runner authority.
Controls and mitigations
- Treat changes to assistant instructions, IDE hooks, lifecycle scripts and CI configurations as executable supply-chain changes, and compare the complete Git object tree rather than relying on indexed code search alone.
Unknowns and contradictions
- The report enumerates modified repositories and payload constructions, not a confirmed victim count. Related GitHub Actions publishing and possible exploit-testing infrastructure are investigative leads, not proof that one operator controlled every adjacent artifact.
Sources and citation
Material revision history
- Oct 27, 2026 · Canonical change recorded · new in release · revision 196