{"data":{"id":"3c86ba08-5ed1-4da2-9e41-f7abed9417e5","title":"Attackers compromised 42 GitHub repositories by using files too large to be searched","summary":"JFrog Security Research reported breaches of 42 third-party GitHub repositories, where attackers deployed payload blobs too large for GitHub search and API paths to detect, including polymorphic wrappers up to 13.7MB. The campaign ties to npm packages named testmetest that stole GitHub and npm credentials and propagated through package registries.","solution":"JFrog recommends that CISOs treat installation of a full-worm version as a host compromise, and that users revoke and rotate all GitHub, GitLab, npm, PyPI, RubyGems, cloud, SSH, Vault, Kubernetes and AI-provider credentials. It also advises auditing repositories for listed hook files and skip-checks:true commits, enumerating repository trees directly rather than relying on GitHub code search or the contents API, deleting unauthorized chore/ci-* and deps/upd-* branches, and disabling malicious workflows.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4241496/attackers-compromised-42-github-repositories-by-using-files-too-large-to-be-searched-2.html","publishedAt":"2026-10-28T02:58:27.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Microsoft"],"affectedVendorsRaw":["AI coding assistants","IDEs","Claude","Gemini","Cursor"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-28T02:58:27.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":["AML.T0010"]}}