A coordinated campaign has compromised forty-two third-party GitHub repositories across eleven legitimate owners, linking them to malicious npm packages distributed under the testmetest label. The threat is delivered through package installations that appear as ordinary utility libraries but execute hidden payloads during setup. The scope includes both direct npm registry infections and the preparation of real developer repositories for automated malicious publishing. Risk is elevated because the infrastructure targets established organizations, using account hijacks and forged commit histories to maintain access. The initial access vector for the broader compromise remains partially obscured, though the connection between npm packages and GitHub infrastructure is confirmed through shared tooling and payload architecture.
The execution mechanism relies on polymorphic wrappers that decode to a hidden CI-publisher payload, often using native addons to camouflage activity. A compiled addon decrypts a local cache file at runtime, revealing a JavaScript payload that bypasses standard detection by checking for CI environments, containers, and debuggers. If the environment is clean, the payload drops a file to a temporary directory and executes it in a detached process. The publisher component operates within GitHub Actions, harvesting tokens and using OIDC exchanges to obtain npm publishing credentials. It then rebuilds target packages, injects malicious post-install scripts, and publishes them back to the registry. This cycle allows the campaign to propagate through package registries while leveraging trusted publishing mechanisms to evade manual review.[/subscribe_to_unlock_form]
A coordinated campaign has compromised forty-two third-party GitHub repositories across eleven legitimate owners, linking them to malicious npm packages distributed under the testmetest label. The threat is delivered through package installations that appear as ordinary utility libraries but execute hidden payloads during setup. The scope includes both direct npm registry infections and the preparation of real developer repositories for automated malicious publishing. Risk is elevated because the infrastructure targets established organizations, using account hijacks and forged commit histories to maintain access. The initial access vector for the broader compromise remains partially obscured, though the connection between npm packages and GitHub infrastructure is confirmed through shared tooling and payload architecture.
The execution mechanism relies on polymorphic wrappers that decode to a hidden CI-publisher payload, often using native addons to camouflage activity. A compiled addon decrypts a local cache file at runtime, revealing a JavaScript payload that bypasses standard detection by checking for CI environments, containers, and debuggers. If the environment is clean, the payload drops a file to a temporary directory and executes it in a detached process. The publisher component operates within GitHub Actions, harvesting tokens and using OIDC exchanges to obtain npm publishing credentials. It then rebuilds target packages, injects malicious post-install scripts, and publishes them back to the registry. This cycle allows the campaign to propagate through package registries while leveraging trusted publishing mechanisms to evade manual review.[emaillocker id="1283"]
The campaign demonstrates active development, with recent shifts to native addon camouflage and the use of encrypted data sinks for receiving snapshot envelopes. The operator maintains a persistent presence through short-lived publishing branches and exposed credentials, indicating a sustained effort to compromise supply chains. Defensive implications include the need to monitor for unusual native addon installations and to audit GitHub Actions workflows for unauthorized token exchanges. Organizations should verify the integrity of package dependencies and review access controls for CI systems to prevent automated malicious publishing. The linkage to shellpanel artifacts suggests a broader operational context, though a continuous execution chain from every infection to specific vulnerabilities is not fully established.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1195.002 | Supply Chain Compromise | Compromise Software Supply Chain |
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Execution | T1059.006 | Command and Scripting Interpreter | Python |
| Execution | T1059.004 | Command and Scripting Interpreter | Unix Shell |
| Defense Evasion | T1027.002 | Obfuscated Files or Information | Encode/Decode File |
| Defense Evasion | T1055.004 | Process Injection | Process Hollowing |
| Defense Evasion | T1070.001 | Indicator Removal | Clear Windows Event Logs |
| Credential Access | T1058.004 | Steal Application Access Token | - |
| Discovery | T1082 | System Information Discovery | - |
| Discovery | T1057 | Process Discovery | - |
| Lateral Movement | T1550.001 | Use Alternate Authentication Material | Application Access Token |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Anti-Behavioral Analysis | B0007 | Sandbox Detection |
| Anti-Behavioral Analysis | B0009 | Virtual Machine Detection |
| Anti-Behavioral Analysis | B0001 | Debugger Detection |
| Discovery | B0013 | Analysis Tool Discovery |
| Anti-Behavioral Analysis | B0025 | Conditional Execution |
| Defense Evasion | B0029 | Polymorphic Code |
| Anti-Static Analysis | E1027 | Obfuscated Files or Information |
| Defense Evasion | F0005 | Hidden Files and Directories |
| File System Micro-objective | C0052 | Writes File |
| Process Micro-objective | C0017 | Create Process |
| Data Micro-objective | C0053 | Decode Data |
| Collection | E1056 | Input Capture |
The following reports contain further technical details:
[/emaillocker]