Attackers Hide 13MB Malware in 42 GitHub Repos
By @sharedot · · 6 pages
- Programming
- Security
- Supply Chain
- Github
JFrog found 42 hijacked GitHub repos armed with oversized AI-assistant hooks that GitHub search and the contents API could not see or return.
The trick: files too big to be searched
The polymorphic wrappers measured as much as 13.7MB — beyond what GitHub code search indexes and what the contents API returns — which is why early analysis found the hooks and concluded the payload files were empty.
The repositories contained execution hooks for AI coding assistants and IDEs, and all wrapper variants decoded to the same hidden CI-publisher payload.
Opening a folder is the detonator
The planted files are execution hooks for Claude, Gemini, Cursor and VS Code: a Claude settings file runs node .github/init.js at session start, with matching triggers for Gemini settings, Cursor's MCP configuration and VS Code folder-open tasks, CyberSecurityNews reports.
Dickson Research principal analyst Frank Dickson told InfoWorld that a routine developer action becomes the detonator, since a developer's laptop holds GitHub tokens, npm tokens, cloud keys and AI-provider credentials.
Tribeca Softech's Aman Mahapatra called .claude/settings.json the new autorun.inf, saying install-time scanning now guards the wrong moment.
Worm, stolen credentials and fake history
Per InfoWorld, JFrog says the npm chain delivered a worm that stole GitHub and npm credentials, poisoned repositories and CI configuration, and propagated through package registries; malicious testmetest releases used a binding.gyp command expansion to execute index.js even without a declared install script.
CyberSecurityNews adds that on September 28 a hijacked account armed 13 repositories in two minutes, with forged commit timelines using copied messages, dates and skip-checks:true markers.
Three npm packages also carried a compiled native addon containing no payload itself, instead decrypting a file named .napi_cache at runtime, and standing down on CI systems, containers, small VMs and debuggers so scanners miss it.
What defenders should do now
JFrog recommends treating installation of a full-worm version as a host compromise, revoking and rotating all GitHub, npm, cloud, SSH, Vault, Kubernetes and AI-provider credentials, and auditing repositories for .github/init.js, .claude/settings.json, .gemini/settings.json, .cursor/mcp.json, .vscode/tasks.json and skip-checks:true commits, according to InfoWorld.
Teams should enumerate repository trees directly rather than relying on GitHub code search or the contents API because of the wrapper size issue.
CyberSecurityNews notes one ordering matters: remove the net-health-checker and pkg-runtime persistence before revoking the stolen GitHub token, because the worm contains a token-revocation wiper, and defenders should block the scanner C2 at 43.228.157.68:80.