{"schema_version":"0.9.0","id":"LR-2026-0250","record_version":2,"title":"Malicious startup hooks in 42 hijacked GitHub repositories execute payload when AI coding assistants open a workspace","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":53.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":7.04,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-28","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"Claude, Gemini, Cursor, and VS Code (IDE/assistant startup hooks)","tools_granted":["shell"],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":"production","integration_type":"embedded","intended_use":"AI coding assistants opening developer workspaces","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-09-28","date_disclosed":"2026-10-28","incident_class":"security_compromise","failure_class":"injection_triggered","agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Hackers armed 42 real GitHub repositories belonging to 11 owners with a large hidden .github/init.js payload that runs via startup hooks in Claude, Gemini, Cursor and VS Code settings.","tags":["supply-chain","github","npm-worm","ide-hooks","credential-theft"],"date_detected":null,"near_miss":null,"root_cause":"adversarial_input","root_cause_detail":"The malicious .github/init.js payload was invoked by trusted tool settings files at session start or folder open, so opening a workspace ran attacker code.","failure_class_detail":"The tools' trusted startup hooks executed the attacker's .github/init.js script when a session started or a folder was opened.","responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":"Malicious .github/init.js and tool settings files (.claude/settings.json, .gemini/settings.json, .cursor/mcp.json, .vscode/tasks.json) in hijacked GitHub repositories","time_to_contain":null,"operations_paused":null,"remediation":"Remove the malicious package versions and rebuild affected systems from trusted sources; rotate GitHub, npm, cloud, SSH, and AI-provider credentials; check every reachable repository for the hook files; read repository trees directly instead of relying on search.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: 42 hijacked repositories across 11 owners were armed with malware that fires in developers' AI coding tools, a live compromise of many third parties.","harm_class":[],"affected_description":"42 GitHub repositories belonging to 11 legitimate owners, including individual developers, students, and one company","protected_class_involved":null,"data_categories_exposed":["credentials"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/hackers-hijack-42-github-repositories/","publisher":"CyberSecurityNews","date":"2026-10-28","type":"press","title":"Hackers Hijack 42 GitHub Repositories to Plant Malware Traps for Claude, Gemini, and Cursor Users","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"D","system.lifecycle_stage":"D","system.integration_type":"D","system.intended_use":"D","system.deployment_context":"D","system.developer":"D","system.autonomy_level":"D","event.date_occurred":"C","event.failure_class":"D","event.tags":"C","event.root_cause":"D","event.responsible_party":"D","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","event.agent_involved":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.affected_description":"C","impact.data_categories_exposed":"D","impact.severity":"D","context.industry":"D","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.harness":[{"source_index":0,"quote":"The traps fire when a developer opens a project with Claude, Gemini, Cursor, or VS Code."}],"system.tools_granted":[{"source_index":0,"quote":"The Claude settings file, for example, runs node .github/init.js || bun .github/init.js at session start."}],"system.deployment_context":[{"source_index":0,"quote":"The traps fire when a developer opens a project with Claude, Gemini, Cursor, or VS Code."}],"system.lifecycle_stage":[{"source_index":0,"quote":"The traps fire when a developer opens a project with Claude, Gemini, Cursor, or VS Code."}],"system.integration_type":[{"source_index":0,"quote":"Small settings files for each tool call this script when a session starts or a folder opens."}],"system.intended_use":[{"source_index":0,"quote":"The traps fire when a developer opens a project with Claude, Gemini, Cursor, or VS Code."}],"event.date_occurred":[{"source_index":0,"quote":"On September 28, scripted batches copied old commit messages and dates from real history and added skip-checks:true."}],"event.failure_class":[{"source_index":0,"quote":"It simply abuses the startup hooks that the tools trust."}],"event.summary":[{"source_index":0,"quote":"Hackers have quietly planted malware in 42 real GitHub repositories."}],"event.tags":[{"source_index":0,"quote":"JFrog says the operator wanted to turn stolen GitHub and npm access into fresh malicious releases, which then feed more stolen access back into the loop."},{"source_index":0,"quote":"The hidden code sits in a file named .github/init.js, and it is huge, between 12.9 MB and 13.7 MB."}],"event.root_cause":[{"source_index":0,"quote":"It simply abuses the startup hooks that the tools trust."}],"event.root_cause_detail":[{"source_index":0,"quote":"Small settings files for each tool call this script when a session starts or a folder opens."}],"event.responsible_party":[{"source_index":0,"quote":"Hackers have quietly planted malware in 42 real GitHub repositories."}],"event.adversarial_actor":[{"source_index":0,"quote":"Hackers have quietly planted malware in 42 real GitHub repositories."}],"event.input_provenance":[{"source_index":0,"quote":"The hidden code sits in a file named .github/init.js, and it is huge, between 12.9 MB and 13.7 MB."}],"event.remediation":[{"source_index":0,"quote":"Defenders should remove the malicious package versions and rebuild affected systems from trusted sources."},{"source_index":0,"quote":"They should rotate GitHub, npm, cloud, SSH, and AI-provider credentials, and check every reachable repository for the hook files above."}],"event.incident_class":[{"source_index":0,"quote":"Hackers have quietly planted malware in 42 real GitHub repositories."}],"event.agent_involved":[{"source_index":0,"quote":"The traps fire when a developer opens a project with Claude, Gemini, Cursor, or VS Code."}],"event.failure_class_detail":[{"source_index":0,"quote":"It simply abuses the startup hooks that the tools trust."}],"impact.affected_description":[{"source_index":0,"quote":"The repositories belong to 11 legitimate owners, including individual developers, students, and one company."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"JFrog says the operator wanted to turn stolen GitHub and npm access into fresh malicious releases, which then feed more stolen access back into the loop."}],"impact.severity_because":[{"source_index":0,"quote":"Hackers have quietly planted malware in 42 real GitHub repositories."}],"context.industry":[{"source_index":0,"quote":"The repositories belong to 11 legitimate owners, including individual developers, students, and one company."}],"impact.severity":[{"source_index":0,"quote":"Hackers have quietly planted malware in 42 real GitHub repositories."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-28"}]},"notes_on_gaps":"Only one source (CyberSecurityNews, press) is present; no primary disclosure, vendor advisory or court filing. event.detection_method left unwritten: the source says JFrog researchers identified the repositories, but no sentence states who first noticed the hook execution itself. event.date_disclosed, system.tier, event.duration, event.time_to_contain and event.date_detected are derived by rule and not written. system.model_name/model_version, system.developer, system.permissions_scope, system.guardrails_present, system.safeguard_state, system.production_intended, event.secondary_failure_classes, event.control_failure, event.operations_paused, event.precursor_events, event.near_miss, impact.direct_loss_usd, impact.records_exposed, impact.third_parties_affected_count, impact.reversibility, impact.protected_class_involved, context.org_size_band, context.country, context.denominator, context.systemic_exposure, context.regulatory, context.coverage and context.incident_evidence are not stated by any source. system.tools_granted 'shell' is classified from the settings file invoking node/bun; the source does not name the tool grant explicitly. event.agent_involved=true is classified from the assistants executing startup hooks; the source does not state autonomy. event.date_occurred is taken from the September 28 commit-batch sentence, which describes the repository arming rather than a confirmed execution date. impact.severity major rests on the 42 hijacked repositories across 11 owners; no dollar loss figure is stated. event.trigger prompt_injection is classified from the startup-hook abuse sentence; the source does not use the word injection. event.trigger: prompt_injection was classified, not stated; a trigger is never inferred, so it is unknown. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-28] system.tools_granted: classified from described behaviour. system.lifecycle_stage: production. system.integration_type: classified from described behaviour. system.intended_use: classified from described behaviour. system.deployment_context: production. system.developer: no source names the developer. system.autonomy_level: no source states the arrangement. event.responsible_party: third_party. event.agent_involved: classified from described behaviour. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. impact.data_categories_exposed: classified from described behaviour. context.industry: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":"Software development / information sector","org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Legitimate GitHub repositories were hijacked and armed with a hidden .github/init.js payload invoked by settings files for Claude, Gemini, Cursor and VS Code when a developer started a session or opened a folder.","quote":"Small settings files for each tool call this script when a session starts or a folder opens.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Opening a workspace ran the attacker's script through trusted startup hooks, breaching the assumption that repository settings are safe to load.","quote":"It simply abuses the startup hooks that the tools trust.","source_index":0,"grade":"C"},{"step":"reached","text":"42 repositories of 11 owners were armed; the payload is a rebuild of a CI publisher meant to push malicious npm releases and harvest GitHub and npm access.","quote":"JFrog says the operator wanted to turn stolen GitHub and npm access into fresh malicious releases, which then feed more stolen access back into the loop.","source_index":0,"grade":"C"},{"step":"caught","text":"JFrog Security Research identified the armed repositories while investigating the \"testmetest\" npm worm; its first sweep found 26 and a direct tree check raised the total to 42.","quote":"Researchers at JFrog Security Research identified the armed repositories while digging into an npm worm they track as the “testmetest” campaign.","source_index":0,"grade":"C"},{"step":"done","text":"JFrog published indicators of compromise and advised removing malicious packages, rebuilding systems, rotating GitHub, npm, cloud, SSH and AI-provider credentials, and checking repositories for the hook files.","quote":"Defenders should remove the malicious package versions and rebuild affected systems from trusted sources.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-28","source_urls":["https://cybersecuritynews.com/hackers-hijack-42-github-repositories/"]}}