Attackers Compromise 42 GitHub Repositories Using Oversized Payloads and AI IDE Hooks
JFrog researchers discovered a supply chain campaign affecting 42 GitHub repos using 13.7MB files to bypass security scanning and exploit AI coding assistant hooks.
A recent security investigation from JFrog Security Research has uncovered a supply chain attack that compromised 42 third-party GitHub repositories. The threat actors deployed polymorphic wrappers as large as 13.7MB—a size specifically selected to exceed the indexing and file-size limits of GitHub’s code search and contents API. Because these automated security tools failed to process the oversized payload blobs, early checks misidentified the malicious files as empty, allowing the campaign to persist unnoticed across compromised repositories.
How the multi-stage campaign operates
The campaign relies on a complex, multi-stage delivery pipeline linked to hijacked npm packages and GitHub infrastructure. SafeDep first detected suspicious npm packages such as [email protected] in late October, categorizing the payload as part of the Miasma family. Rather than declaring traditional installation scripts, the attack leveraged binding.gyp command expansions to execute index.js during package setup.
The loader applied a per-build Caesar transformation to decrypt an AES-128-GCM payload, subsequently downloading or locating Bun 1.2.18 to run the primary code. Once active, the npm worm harvested credentials, corrupted repository and continuous integration (CI) configurations, and spread across package registries. Armed payload files, such as ci.js, were deployed into hijacked repositories to execute via GitHub Actions, using stolen npm tokens or trusted publishing mechanisms to publish additional malicious releases.
To evade analysis, the attackers utilized a compiled native addon that carries no payload itself. Instead, it decrypts a hidden file named .napi_cache at runtime. The native addon is designed to stand down when running inside containers, small virtual machines, CI systems, or under debuggers, and halts execution on Windows if Wireshark or Process Monitor is detected. Additionally, Shellpanel artifacts tied the victim cluster to previously documented GitHub Actions exploits targeting internet-facing cPanel systems.
What it means for developers
This campaign represents a tactical shift in how supply chain attacks target software engineers. Rather than relying on a developer manually installing or executing a malicious package, the attackers embedded execution hooks directly into IDE and AI coding assistant configuration files. These included Claude Code SessionStart hooks, Gemini settings, Cursor MCP configurations, and VS Code folder-open tasks.
Aman Mahapatra, chief strategy officer at Tribeca Softech, noted that attackers have effectively shifted the execution trigger from running code to simply opening a directory. He stated that ".claude/settings.json is the new autorun.inf," pointing out that traditional install-time security scanning fails to protect against triggers activated upon folder opening. Frank Dickson, principal analyst at Dickson Research, added that while the root cause remains stolen credentials rather than flaws in the AI tools themselves, configuration features that execute code upon opening a project require the same scrutiny as build scripts.
Because developer workstations often contain sensitive access tokens, compromise of these AI hooks puts cloud keys, package registry tokens, and AI provider credentials at risk. For teams integrating automated coding assistants into their workflow, managing API keys securely is critical. Developers can try top AI models cheaply through one API at https://apixoai.online, which helps consolidate access management across multiple provider environments.
Defense and remediation strategies
JFrog recommends that organizations treat any full-worm installation as a total host compromise. CISOs and security teams are advised to immediately revoke and rotate all active credentials across GitHub, GitLab, npm, PyPI, RubyGems, cloud platforms, SSH, Vault, Kubernetes, and AI providers.
To detect hidden components, teams should bypass GitHub search and contents APIs by enumerating repository file trees directly. Repositories should be audited for suspicious execution hooks, such as .github/init.js, .claude/settings.json, .gemini/settings.json, .cursor/mcp.json, .cursor/rules/setup.mdc, .vscode/tasks.json, unexpected Makefile or composer.json hooks, and commits marked with skip-checks:true.
Further mitigation steps include deleting unauthorized chore/ci-* and deps/upd-* branches, removing fake CodeQL scan-output artifacts, and disabling malicious workflows. Organizations should block network controls to 43.228.157.68:80 and search GitHub Actions logs and runner environments for artifacts like /tmp/.svc, ipscan, CVE-2026-41940, architecture-specific download requests (/api/dl/<arch>), and .napi.cache files.
Source: Attackers compromised 42 GitHub repositories by using files too large to be searched — InfoWorld AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
