Hackers hid malware in 42 real GitHub projects. Opening one in Claude, Gemini, Cursor or VS Code could run it, putting passwords and business accounts at risk.
Hackers have planted malware in 42 real GitHub projects, and the trap can spring when a developer simply opens one in an AI coding tool. Claude, Gemini, Cursor and VS Code are all affected. The projects belong to 11 legitimate owners, including individual developers, students and one company.
GitHub is a popular site where people store and share code. The attackers hid a script in a file named .github/init.js. Small settings files for each tool call that script when a session starts or a folder opens. No clever trick on the user is needed. The attack uses startup steps the tools already trust.
Researchers at JFrog Security Research found the projects while studying an npm worm they call the "testmetest" campaign. npm is a library of code packages that developers download. Another firm, SafeDep, described the npm side on October 22 and reported no confirmed victims.
The hidden file is huge, between 12.9 MB and 13.7 MB. GitHub search did not index files that big, and the files looked empty at first. JFrog's first sweep found 26 projects. Reading the project file lists directly raised the count to 42.
The attacker also faked history. On September 28, scripted batches copied old commit messages and dates from real history, so the activity looked much older than it was. JFrog says the goal was to turn stolen GitHub and npm access into new malicious releases, which then steal more access.
Developers and companies that use GitHub, npm, Claude, Gemini, Cursor or VS Code are the main targets, especially anyone who opened an affected project. If you run a business that relies on outside developers, ask whether they open code from GitHub in these tools. People who do not work with code are not directly exposed.
One related finding is less clear. JFrog found scanner tools in the same hijacked accounts that look for cPanel and WHM systems with a known flaw. It found no proof that any cPanel server was actually breached.
The alert box above lists the steps. One detail matters most: the worm contains a wiper that triggers when a stolen token is revoked. So remove its persistence files first, then change passwords and keys.
More hijacked projects may turn up, since the first search missed 16 of them. Until then, treat any unfamiliar project as untrusted before opening it in an AI tool.
Do not open unfamiliar GitHub projects in AI coding tools, and check your own for a .github/init.js file before changing any passwords.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youEA has re-released 25 classic PC games at a discount until November 19, and Bethesda has finally given The Elder Scrolls VI a subtitle: Sentinel.
Read more: EA brings 25 classic PC games back, and Elder Scrolls VI gets a name
