Malware · Application Security
Malware campaign arms 42 GitHub repositories with hidden payloads
A new malware campaign has secretly compromised 42 GitHub repositories by hiding large, hard-to-detect payloads. The attack targets developers and uses advanced evasion techniques, according to JFrog researchers.
Ross Grant3 min read
The short version
Researchers found that 42 GitHub repositories were secretly compromised by malware that was hard to detect because it used very large files. The attack targeted developers, especially those using AI coding tools, and tried to steal credentials. The malware could also delete files if it was discovered. This shows that even trusted code platforms can be targeted by advanced attacks.
By the numbers
- 42GitHub repositories compromisedThe Register
- 11repository owners affectedThe Register
- 12.9–13.7 MBsize of payload blobs used to evade detectionThe Register
- 18npm packages linked to the operatorThe Register
What happened?
A new malware campaign compromised 42 GitHub repositories by hiding large, hard-to-detect payloads, according to JFrog researchers cited by The Register. The attack used a self-replicating npm worm to steal credentials and modify repositories, targeting developers and AI coding tools. The campaign was first spotted in October 2026, but the full scale was only revealed after further analysis. No official statement from GitHub has been made.
Who is affected
According to JFrog researchers, 42 real GitHub repositories from 11 different owners were compromised in this campaign. These included established developers and organisations. The attackers targeted repositories used by AI coding assistants and development tools such as Claude, Gemini, Cursor, and VS Code. The campaign also involved the npm package ecosystem, with 18 packages linked to the same operator identified by SafeDep between 19 and 25 October.
How the attack worked
The attackers used a self-replicating npm worm, which means the malware could spread itself by infecting more packages. It stole credentials, modified repositories and CI (continuous integration) configurations, and installed a wiper that deleted the victim's home directory if the stolen GitHub token was revoked. The malware included code from previous npm worms and added new features, such as a wiper from another malware family.
A key evasion tactic was the use of large payload blobs (12.9 to 13.7 MB), which were too big for GitHub's code search and API tools to scan effectively. The attackers also planted execution hooks for popular development tools and used polymorphic wrappers, code that changes itself to avoid detection. The malware checked for signs of automated analysis, such as CI runners, containers, sandboxes, or debuggers, and would exit silently if it detected them.
Some builds of the malware used a compiled native add-on to decrypt and launch a hidden payload. Others skipped the encrypted file and instead downloaded a loader from a repository controlled by the attacker. The operator's GitHub account, CementBeetleSteeple, hosted 17 campaign repositories.
The response
The campaign was first spotted by SafeDep, who initially believed only test accounts were affected. However, JFrog's later analysis showed that real repositories had been compromised. The researchers connected the attacker's infrastructure to previous campaigns that abused GitHub Actions and exploited CVE-2026-41940, an authentication bypass flaw in cPanel and WHM. While the attackers attempted to exploit this vulnerability on a large scale, JFrog did not confirm any downstream cPanel compromises.
What you should do
Developers using GitHub and npm should review their repositories for unusual large files or unexpected changes to CI configurations. It's important to monitor for suspicious activity, especially if using AI coding assistants or automated tools. Regularly update dependencies and use security tools that can scan for large or obfuscated files. If you believe your credentials may have been stolen, rotate them immediately and check for signs of unauthorised access.
This story is based on a single report from The Register, citing JFrog and SafeDep researchers. No primary source or official statement from GitHub is available yet. The full extent of the impact and whether any downstream cPanel servers were compromised remains unconfirmed.
Why it matters
This attack shows that malware can hide in open source code repositories, making it harder for developers to spot threats. It also highlights the risks of supply chain attacks, where trusted tools or code are compromised. Developers and organisations should be alert to changes in their code and use security tools that can detect unusual files.
Key points
- 42 GitHub repositories from 11 owners were compromised by a stealthy malware campaign.
- Attackers used large payloads (12.9–13.7 MB) to evade GitHub's code search and detection tools.
- The malware targeted developers using AI coding assistants and could steal credentials.
- Some versions of the malware included a wiper that deleted files if the attack was detected.
- No official statement from GitHub or confirmation of downstream cPanel compromises yet.
Sources
The Register
Reference
