Cases › security breach › LR-2026-0250
Malicious startup hooks in 42 hijacked GitHub repositories execute payload when AI coding assistants open a workspace
Developing · first published 2026-10-28 09:34 UTC. Later changes are logged on the corrections page.
Severity major: 42 hijacked repositories across 11 owners were armed with malware that fires in developers' AI coding tools, a live compromise of many third parties.
Happened 2026-09-28 · Earliest source we hold 2026-10-28, 30 days later
Hackers armed 42 real GitHub repositories belonging to 11 owners with a large hidden .github/init.js payload that runs via startup hooks in Claude, Gemini, Cursor and VS Code settings.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingLegitimate GitHub repositories were hijacked and armed with a hidden .github/init.js payload invoked by settings files for Claude, Gemini, Cursor and VS Code when a developer started a session or opened a folder.
2 · What went wrongOpening a workspace ran the attacker's script through trusted startup hooks, breaching the assumption that repository settings are safe to load.
3 · What it reached or did42 repositories of 11 owners were armed; the payload is a rebuild of a CI publisher meant to push malicious npm releases and harvest GitHub and npm access.
4 · How it was caughtJFrog Security Research identified the armed repositories while investigating the "testmetest" npm worm; its first sweep found 26 and a direct tree check raised the total to 42.
5 · What was doneJFrog published indicators of compromise and advised removing malicious packages, rebuilding systems, rotating GitHub, npm, cloud, SSH and AI-provider credentials, and checking repositories for the hook files.
What the sources state
- Cause hostile input carried instructions
No source states: when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Show every field, with its source and grade
The AI system
Software around the model
Claude, Gemini, Cursor, and VS Code (IDE/assistant startup hooks)
C one secondary source states it
Tools it was given
shell
D inferred by us from the described behaviour, reason shown
Stage of use
in live use
D inferred by us from the described behaviour, reason shown
How it was connected
built into a product
D inferred by us from the described behaviour, reason shown
What it was for
AI coding assistants opening developer workspaces
D inferred by us from the described behaviour, reason shown
What happened
When it happened
2026-09-28
C one secondary source states it
Earliest source we hold
2026-10-28
A the date the source itself carries
Themes
supply chain, GitHub, npm worm, ide hooks, credential theft
C one secondary source states it
Cause
hostile input carried instructions
D inferred by us from the described behaviour, reason shown
Cause in detail
The malicious .github/init.js payload was invoked by trusted tool settings files at session start or folder open, so opening a workspace ran attacker code.
D inferred by us from the described behaviour, reason shown
Who was responsible
an outside party
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
Malicious .github/init.js and tool settings files (.claude/settings.json, .gemini/settings.json, .cursor/mcp.json, .vscode/tasks.json) in hijacked GitHub repositories
C one secondary source states it
What was done
Remove the malicious package versions and rebuild affected systems from trusted sources; rotate GitHub, npm, cloud, SSH, and AI-provider credentials; check every reachable repository for the hook files; read repository trees directly instead of relying on search.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
D inferred by us from the described behaviour, reason shown
What it did
The tools' trusted startup hooks executed the attacker's .github/init.js script when a session started or a folder was opened.
D inferred by us from the described behaviour, reason shown
Impact
Severity
major
D inferred by us from the described behaviour, reason shown
Who was affected
42 GitHub repositories belonging to 11 legitimate owners, including individual developers, students, and one company
C one secondary source states it
Kinds of data exposed
credentials
D inferred by us from the described behaviour, reason shown
Why this severity
42 hijacked repositories across 11 owners were armed with malware that fires in developers' AI coding tools, a live compromise of many third parties.
D inferred by us from the described behaviour, reason shown
Context
Industry
Software development / information sector
D inferred by us from the described behaviour, reason shown
LR-2026-0250 · version 2 · published 2026-10-28 after automatic checks; not yet checked field by field by a person · changes to this case · JSON