Evidence · DiggingBeagle record
JFrog: Beyond testmetest, 42 hijacked repositories and agent configuration hooks
JFrog: Beyond testmetest, 42 hijacked repositories and agent configuration hooks
- Source role
- primary disclosure
Evidence record
JFrog: Beyond testmetest, 42 hijacked repositories and agent configuration hooks
Claim-level citations (2)
- supportsForty-two hijacked repositories carried testmetest agent hooks: JFrog describes native-addon carriers that decrypt a separate .napi_cache file with XOR 0x96 and suppress execution in CI, small virtual machines, containers or debugging environments before launching a detached Node process.
JFrog October 26 report, A native addon hides the payload in .napi_cache and It only runs where nobody is watching
- supportsForty-two hijacked repositories carried testmetest agent hooks: JFrog identifies 42 armed GitHub repositories belonging to 11 legitimate owners and agent-related hook locations under Claude, Gemini, Cursor and VS Code configuration. It describes payload-hiding and native-module loader behavior but not 42 verified executions.
Overview; infected repository inventory; agent hooks and payload extraction analysis