Observed incident

testmetest campaign plants startup hooks for AI coding assistants

Reported

Published here

What happened

JFrog identified 42 armed GitHub repositories belonging to 11 legitimate owners, with startup hooks targeting Claude, Gemini, Cursor and VS Code. Hidden payloads supported credential theft and malicious npm publishing.

Parties and reporting

AI tools and systems: Claude Code hooks, Gemini settings, Cursor MCP configuration, VS Code tasks, npm and GitHub Actions

Outcome

Repository compromise and malicious artifacts were reported; execution on every downstream developer machine was not established. SafeDep reports package removals followed by renewed publication and a load-time trigger that bypasses install-script controls.

Operating lesson

Isolate affected hosts immediately; coordinate credential revocation from a clean system with containment of the reported revocation-triggered wiper. Rebuild hosts and audit repository and CI persistence before reuse.

Evidence and limits

October 22 is the earliest reviewed campaign disclosure; JFrog disclosed the 42-repository finding October 26 and dates earlier activity to July and September. The original Miasma operators are not attributed. Attempted cPanel exploitation is not proof of downstream cPanel compromise. AI/editor hooks are an execution surface, not evidence of malicious model reasoning.

Sources