Skip to content

An npm worm plants Claude Code and Cursor hooks to steal tokens

JFrog found 42 GitHub repositories armed with a worm that runs when your AI coding tool starts a session, not just when you run npm install.

Source: JFrog Security Research

JFrog Security Research said on 26 October that it had found 42 GitHub repositories, across 11 legitimate developers and organisations, armed with a fresh wave of the “testmetest” npm worm. The researcher who first flagged the campaign on 22 October, SafeDep, had reported no confirmed third-party victims at that point; JFrog’s deeper look at the GitHub side found the operator had already armed real projects.

The worm plants hooks that AI coding tools run automatically on startup, not on npm install. A Claude Code SessionStart hook runs this, with equivalents planted for Gemini, Cursor’s MCP config and VS Code’s folder-open tasks:

node .github/init.js || bun .github/init.js

The hidden payload harvests GitHub tokens, checks repositories for npm’s OIDC trusted-publishing setup, then tries to republish the owner’s own packages with a malicious postinstall script to spread further. JFrog says it recovered real, working npm tokens stolen from six repositories, and that the worm wipes the host’s files if the stolen GitHub token is revoked.

Why it matters: opening a project in Claude Code, Cursor or VS Code is now itself an attack step, because a compromised dependency can drop a session-start hook that runs before you type anything. Check .claude/settings.json, .cursor/mcp.json and .vscode/tasks.json in any repository you don’t fully trust, and treat an unexpected hook there as a compromise, not a bug.

Share

Related reading

Engineering

How to patch PHP in a hurry without breaking production

PHP ships an out-of-band fix for two critical flaws at 14:00 UTC today. Here is the hour of preparation that turns the patch into a non-event, and the runbook for when it lands.

ML for Web Devs

Tokens, context windows, and why your bill is what it is

The unit of billing for language models is not the request or the word. Once you understand tokens and how a context window fills up, the invoice stops being a surprise.

ML for Web Devs

RAG is just search with extra steps

Retrieval-augmented generation gets written up like an architecture. It is a search query, a string concatenation and one API call, and the search query is the part that decides whether it works.

More from The Wire

All briefs