The report
A repository can contain an attack against the assistant that opens it, even when its apparent source code looks ordinary. On October 26, JFrog researchers described 42 GitHub repositories controlled by 11 legitimate owners in which malicious changes were placed in assistant or editor configuration directories. The evidence supports a compromised-repository campaign, not 42 confirmed infected developer machines.
Execution moved into assistant configuration
The investigation describes hooks in directories used by Claude, Gemini, Cursor and VS Code. Some altered repositories carried large JavaScript wrapper files of roughly 12.9 to 13.7 MB. Their size and placement made routine source-search views an incomplete account of the repository contents; the objects could still be recovered through Git trees and blobs. The technical investigation also reports native add-on components, including a separately encoded .napi_cache payload and conditional execution designed to avoid selected inspection environments.
Researchers Guy Korolevski and Yair Benamou trace related publishing and execution elements, including GitHub Actions token-handling behavior. Their findings distinguish an armed repository, a hook that fires in a particular agent environment, an executed payload, and confirmed theft. Public data do not demonstrate that every affected repository was opened by a vulnerable assistant or that all detected tokens were successfully used.
The design error to investigate
A source checkout or code-review action is not automatically consent to run commands supplied by that source. When an agent treats project-local configuration as trusted execution policy, repository contents cross into its tool authority. That is the AI-specific mechanism here. A compromised repo is the delivery surface; the agent and its permissions determine the possible effect. The underlying case preserves the observed artifacts and the limits of victim attribution.
An actionable review needs to examine hidden and oversized Git blobs, the effective hooks read by each agent, process launches in local logs and CI, and whether job-scoped credentials could be exchanged or reused. Checking only a conventional package manifest is insufficient for this particular path.
Status: repositories and embedded execution paths were identified. Execution across all installations, a total victim count, and attribution to one human operator remain unproven.