githash
docs
testmetest active
npm worm that arms hijacked GitHub repos with a hidden script run by AI and editor hooks.
An npm worm first seen in testmetest-named packages that steals GitHub and npm credentials, then uses them to plant a 13 MB obfuscated .github/init.js in real repositories along with hooks that run it: a Claude or Gemini SessionStart hook, a VS Code task on folder open, a Cursor rule and MCP server, and package.json, composer or Makefile scripts. The file is padded past what GitHub code search indexes. Arming commits copy old dates and use the message "shellpanel execution smoke"; the same operator runs GitHub Actions workflows that scan for cPanel servers vulnerable to CVE-2026-41940.
- also known as
- shellpanel, @iobandamwer, CementBeetleSteeple
references
spread over time
Press play to watch the threat spread, or drag the slider to pick dates.
Loading graph…
known-malicious hashes · 116
| sha-256 | file names | repos | files | first seen | last seen |
|---|---|---|---|---|---|
| 67f28e8da0d4adfd… | ci-79059.yml |
1 | 1 | ||
| 181340470b7401bd… | ci-507505.yml |
1 | 1 | ||
| e2a2981ff7d03a2e… | ci-419282.yml |
1 | 1 | ||
| 926f4e9177732b36… | ci-765816.yml |
1 | 1 | ||
| 79d8177685560535… | ci-134652.yml |
1 | 1 | ||
| badf910ca1fcf175… | ci-309329.yml |
1 | 1 | ||
| e3cb383615fc70bc… | shellpanel-legacy-compat-mock.py |
892 | 892 | ||
| 17614e98b613b17d… | shellpanel-legacy-compat-tool.sh |
878 | 878 | ||
| c65ebc941c19fb5c… | ci-477138.yml |
1 | 1 | ||
| ba0d5837d69de21e… | init.js |
1 | 1 | ||
| d221b6244e6bcf2f… | ci-395159.yml |
1 | 1 | ||
| 48b7b03c5c1ee349… | ci-413635.yml |
1 | 1 | ||
| 1f79ad6e7f039370… | ci-458303.yml |
1 | 1 | ||
| 1cc4428fd589c585… | ci-848922.yml |
1 | 1 | ||
| b619944c979d7506… | ci-367133.yml |
1 | 1 | ||
| 67cc55979fd89053… | ci-568880.yml |
1 | 1 | ||
| 611523415ce13456… | ci-170938.yml |
1 | 1 | ||
| fc1261f9614cb06c… | ci-235652.yml |
1 | 1 | ||
| 393453c35dc31c09… | ci-354679.yml |
1 | 1 | ||
| f3172c9671a2ddd8… | ci-45987.yml |
1 | 1 | ||
| e5171b20b6f93cf9… | ci-160190.yml |
1 | 1 | ||
| c4202eb4f6f9b78b… | ci-961392.yml |
1 | 1 | ||
| 8493ef5629e698e2… | ci-329031.yml |
1 | 1 | ||
| 3023385cbab5f5b3… | ci-60011265.yml |
1 | 1 | ||
| 6538d19fff9dfbba… | ci-60003072.yml |
1 | 1 |