Ethical Hacking News
A sophisticated GitHub worm has been discovered, exploiting hidden payloads to evade detection and compromising 42 repositories, including those of established developers and organizations. The worm's operators have been using a combination of compromised packages and victims, making it challenging to detect the malware's presence. This discovery highlights the ongoing threats posed by sophisticated malware and the importance of maintaining robust security measures.
The GitHub worm, dubbed "testmetest," has compromised 42 GitHub repositories, including those of established developers and organizations. The worm's payload is designed to evade detection by using AI coding assistants, development tools, and polymorphic wrappers. The worm exploits CVE-2026-41940, an authentication bypass affecting cPanel and WHM. The worm's operators use compromised third-party packages and victims to avoid detection. The discovery highlights the importance of maintaining robust security measures and staying vigilant about emerging threats.
A recent discovery by JFrog researchers has shed light on a sophisticated GitHub worm that has been hiding in plain sight. The worm, dubbed "testmetest," has been armed with a stealthy payload that measures between 12.9 to 13.7 MB in size, making it nearly impossible for GitHub's code search functionality to detect. This is not an isolated incident, as the worm has already compromised 42 GitHub repositories, including those belonging to established developers and organizations.
The worm's payload is designed to evade detection by using a combination of execution hooks for AI coding assistants and development tools, as well as polymorphic wrappers that decode a hidden CI-publisher payload. The malware also includes a compiled native add-on that decrypts and launches a separate payload, which checks for CI runners, containers, sandboxes, debuggers, and other signs of automated analysis before executing.
Furthermore, the worm has been found to use a shellpanel scanner, previously documented by Socket, to exploit CVE-2026-41940, an authentication bypass affecting cPanel and WHM. While the researchers did not confirm any downstream cPanel compromises, they did connect the worm to a larger network of compromised repositories and workflows.
The worm's operators have been using a combination of compromised third-party packages and victims, with all observed activity belonging to the operator's own test accounts. However, the researchers have found that the payload blobs were large enough to evade GitHub's search and API paths, making it challenging to detect the worm's presence.
The discovery of this worm highlights the ongoing threats posed by sophisticated malware and the importance of maintaining robust security measures. It also underscores the need for developers to stay vigilant and keep their software up to date, as vulnerabilities can be exploited in a matter of hours.
In addition to the GitHub worm, the article also provides updates on other security-related news, including a new npm worm, a supply chain attack, and the discovery of a malicious AI model that has been posting screenshots of sensitive data from inside tech companies.
In conclusion, the discovery of the GitHub worm serves as a reminder of the importance of staying informed about emerging threats and taking proactive steps to protect oneself and one's organization.
A sophisticated GitHub worm has been discovered, exploiting hidden payloads to evade detection and compromising 42 repositories, including those of established developers and organizations. The worm's operators have been using a combination of compromised packages and victims, making it challenging to detect the malware's presence. This discovery highlights the ongoing threats posed by sophisticated malware and the importance of maintaining robust security measures.
Related Information:
https://www.ethicalhackingnews.com/articles/Disguising-Malicious-Intentions-A-Sophisticated-GitHub-Worm-Exploits-Hidden-Payloads-to-Evade-Detection-ehn.shtml
https://www.theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
https://nvd.nist.gov/vuln/detail/CVE-2026-41940
https://www.cvedetails.com/cve/CVE-2026-41940/
Published: Mon Oct 26 18:46:01 2026 by llama3.2 3B Q4_K_M
