42 Weaponized GitHub Repositories Reveal a Hidden npm Publisher

Summary

A sophisticated campaign tracked as testmetest uses malicious npm packages and compromised GitHub repositories to steal credentials and automate malicious package releases. The attackers rely on polymorphic wrappers, native Node.js addons, and encrypted payloads to evade detection. The campaign also involves infrastructure used to scan for and exploit cPanel vulnerabilities.

Investigation

JFrog Security researchers identified 42 weaponized GitHub repositories along with multiple malicious npm packages. They found that the attackers used a native addon camouflage technique in which a compiled .node file decrypts a concealed payload at runtime. The investigation also linked the activity to shellpanel scanners targeting cPanel systems through CVE-2026-41940.

Mitigation

Users should remove identified malicious npm packages and rebuild affected systems from trusted sources. Organizations must rotate all potentially compromised credentials, including GitHub, npm, and cloud tokens. It is also critical to audit repositories for unauthorized configuration files such as .github/init.js and unexpected execution hooks in package.json files or Makefiles.

Response

When malicious activity is detected, revoke exposed secrets and rotate credentials immediately. Hunt for persistence mechanisms such as net-health-checker or pkg-runtime. Review GitHub Actions logs for unauthorized workflows and monitor systems for decrypted payloads written to temporary directories.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully dropped a malicious JavaScript payload into the user’s temporary directory, naming it .nc to potentially mimic a Netcat-related file or simply to obfuscate its purpose. To execute this, the adversary utilizes a loader that invokes the CreateProcessA Win32 API to launch the Windows Script Host (wscript.exe) with the temporary file as an argument. This specific sequence—using the ANSI version of the process creation API to run a script from %TEMP%—is the exact pattern the detection rule is designed to intercept.

• Regression Test Script:

    # Simulation Script: Triggering 'Suspicious Process Creation and Temporary JS File Execution'
  
    # 1. Define paths
    $tempPath = $env:TEMP
    $targetFile = Join-Path $tempPath ".nc"
  
    # 2. Create a dummy malicious JS file in the %TEMP% directory
    # Note: We name it .nc as per the detection logic requirement
    "WScript.Echo('Malicious Activity Simulated');" | Out-File -FilePath $targetFile -Encoding ascii
  
    Write-Host "[+] Malicious file created at: $targetFile"
  
    # 3. Simulate the execution via wscript.exe
    # In a real scenario, the 'CallTrace' containing 'CreateProcessA' is generated 
    # by the underlying Windows API call used by the malware loader.
    # Running this via PowerShell/CMD will generate the process creation event.
    Write-Host "[+] Executing script to trigger detection..."
    Start-Process "wscript.exe" -ArgumentList "`"$targetFile`""
  
    Write-Host "[+] Simulation command sent."

• Cleanup Commands:

    # Cleanup Script: Remove simulation artifacts
    $tempPath = $env:TEMP
    $targetFile = Join-Path $tempPath ".nc"
  
    if (Test-Path $targetFile) {
        Remove-Item -Path $targetFile -Force
        Write-Host "[+] Cleanup successful: $targetFile removed."
    } else {
        Write-Host "[!] Cleanup failed: File not found."
    }