TI Mindmap HUB
Threat Intelligence Report

Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher

๐Ÿ“… October 27, 2026 ๐Ÿ“ฐ research.jfrog.com ๐Ÿ” 1 CVE(s) referenced

The testmetest npm campaign hijacked legitimate GitHub accounts to arm 42 repositories with stealthy publishers, AI/IDE execution hooks, credential theft, cPanel exploitation workflows, and native-addon malware engineered to evade automated analysis.

vendor
CVE-2026-41940

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

๐Ÿ” Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

๐Ÿ“Š Visual Mindmap
๐ŸŽฏ IOC Extraction
โš”๏ธ MITRE ATT&CK TTPs
๐Ÿ“ฆ STIX 2.1 Bundle