Preliminary research

Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm Publisher

Guy Korolevski and Yair Benamou · JFrog · 26 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Trace package-native loaders and agent/IDE startup hooks into oversized unindexed repository payloads and context-bound CI publishing. Tree/blob enumeration corrects a misleading code-search view.

Record

Researcher

Guy Korolevski and Yair Benamou

Published by

JFrog

Date

26 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Earlier worm report and updates

Tags

• supply-chain
• ci-cd
• ai-agent
• native-addon
• owasp-a06-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Guy Korolevski and Yair Benamou, first published at the original source. Preserved copies are kept so the citation survives its host.