Attackers compromised 42 GitHub repositories by using files too large to be searched

Summary

JFrog Security Research reported breaches of 42 third-party GitHub repositories, where attackers deployed payload blobs too large for GitHub search and API paths to detect, including polymorphic wrappers up to 13.7MB. The campaign ties to npm packages named testmetest that stole GitHub and npm credentials and propagated through package registries.

Mitigation

JFrog recommends that CISOs treat installation of a full-worm version as a host compromise, and that users revoke and rotate all GitHub, GitLab, npm, PyPI, RubyGems, cloud, SSH, Vault, Kubernetes and AI-provider credentials. It also advises auditing repositories for listed hook files and skip-checks:true commits, enumerating repository trees directly rather than relying on GitHub code search or the contents API, deleting unauthorized chore/ci-* and deps/upd-* branches, and disabling malicious workflows.

Related items

• InfoChart: Anthropic's cash pile towers over nearly every U.S. companySame vendor · CNBC Technology
• LowBank of America kindly asks that you don’t share your banking password with your AI assistantSame vendor · TechCrunch (Security)
• InfoAnthropic accelerates – for the rest of us, the speed of growth spells precaritySame vendor · The Guardian Technology
• InfoThe Download: Anthropic’s IPO, smarter power grids, and exercise pillsSame vendor · MIT Technology Review
• InfoFrom Wall Street to Silicon Valley, Anthropic IPO poised to have massive 'trickle-down effect'Same vendor · CNBC Technology