{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/jfrog-testmetest-agent-hooks-2026/",
 "asOf": "2026-10-30",
 "id": "jfrog-testmetest-agent-hooks-2026",
 "date": "2026-10-26",
 "datePrecision": "day",
 "title": "JFrog identifies 42 hijacked repositories carrying execution hooks for coding assistants and IDEs",
 "lane": "attack",
 "kind": "misuse-report",
 "summary": "JFrog reports 42 armed third-party GitHub repositories across 11 legitimate owners linked to the testmetest npm campaign. Recovered artifacts included malicious publishers and execution hooks for Claude, Gemini, Cursor and VS Code; repository counts do not establish the number of infected developer machines or downstream executions.",
 "whyItMatters": "It documents agent and IDE configuration becoming an execution surface within a broader software supply-chain compromise.",
 "actors": [
  "jfrog",
  "github"
 ],
 "topics": [
  "agent-supply-chain",
  "tool-and-mcp-security",
  "data-exfiltration"
 ],
 "atlas": [
  "supply-chain",
  "tools",
  "credentials"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://research.jfrog.com/post/beyond-testmetest-42-hijacked-github-repos/",
   "publisher": "JFrog",
   "title": "Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher",
   "date": "2026-10-26",
   "type": "primary",
   "accessed": "2026-10-30"
  }
 ],
 "keyFacts": [
  {
   "fact": "JFrog identified 42 armed repositories after enumerating owner repositories and inspecting trees and blobs. Oversized payloads escaped normal code-search and content-API paths; the 42 are the identified armed repositories, not the total population searched.",
   "locator": "42 armed repositories hiding in plain sight"
  },
  {
   "fact": "Snapshot metadata in an attacker-owned repository did not reveal victim identities, affected-system counts or plaintext contents. Recovered publisher code establishes intended automation, not execution of every release.",
   "locator": "The exfiltration decoy became a live data sink; The hidden ci.js publisher"
  },
  {
   "fact": "The investigators distinguish malicious releases from benign campaign-associated versions and do not establish that the original Miasma operators were responsible.",
   "locator": "Introduction; Package classifications"
  }
 ],
 "significance": 4,
 "fideQuestions": [],
 "methods": [
  "malicious-agent-extensions"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-30",
 "revisions": []
}