Malicious GitHub Repositories Target AI Coding Assistants

Executive Summary

Malicious GitHub repositories and npm packages are being used to target software developers and AI-assisted development environments. The campaign uses concealed scripts, malicious configuration files and package installation mechanisms to execute code, steal credentials and abuse software publishing permissions. The activity involves repositories associated with legitimate owners, making it more difficult for developers to distinguish malicious content from trusted code. Malicious components can be triggered when developers open certain workspaces, launch AI coding assistants or install affected dependencies.

The potential consequences include developer endpoint compromise, source-code exposure, theft of GitHub and npm credentials, unauthorised changes to software repositories and the introduction of malicious code into downstream applications.

Organisations in Nigeria and across Africa that use AI coding assistants, open-source dependencies, GitHub Actions or npm packages should review their development environments and software supply chain controls. The immediate priorities are to identify potentially affected systems, investigate suspicious code execution, protect developer credentials and restrict unauthorised software publishing.

What Is the Threat?

The campaign, identified as the testmetest campaign, involves malicious GitHub repositories and npm packages designed to exploit trust in developer tools and software distribution platforms. The attackers conceal malicious functionality in JavaScript files, repository configuration files and package components. Certain configurations can trigger commands when AI coding assistants start sessions or when developers open workspaces in their integrated development environments (IDEs).

The activity targets development workflows involving Claude Code, Gemini, Cursor and VS Code. Malicious npm packages may also execute code during installation or use concealed payloads to perform additional actions on a compromised system. The malware is designed to steal developer credentials and abuse access to source-code repositories and package registries. Where stolen credentials have sufficient permissions, attackers may be able to modify code, alter automated workflows or publish malicious package versions. This activity demonstrates how software supply chain attacks can exploit legitimate development platforms and automation features to gain access to organisational systems.

Who Is Affected?

The threat is relevant to organisations that:

• Use AI coding assistants to analyse, modify or generate software.

• Open third-party or unfamiliar GitHub repositories in development environments.

• Install npm packages without adequate security validation.

• Use GitHub Actions for software builds, testing and deployment.

• Allow developers or CI/CD pipelines to access production credentials and cloud resources.

• Maintain internal software libraries or publish packages to public registries.

• Rely on outsourced developers, open-source components or third-party software providers.

Financial institutions, telecommunications providers, technology businesses, public-sector organisations and critical infrastructure operators should assess their exposure where these tools and workflows are used. The primary concern is the potential compromise of developer identities and software delivery processes. Exposure should be determined through investigation rather than assumed from the use of an affected platform alone.

Technical Details

Malicious repository configuration files

The campaign uses developer-tool configuration files to introduce commands that may execute when a workspace is opened or an AI coding session begins. Suspicious locations include:

• .claude/settings.json

• .gemini/settings.json

• .cursor/mcp.json

• .cursor/rules/setup.mdc

• .vscode/tasks.json

These files can have legitimate uses, their presence alone does not indicate compromise; unexpected commands, unfamiliar URLs and unauthorised configuration changes require investigation.

Business Impact and Risk Assessment

Recommendations

• Audit GitHub repositories, AI coding assistant configurations, npm dependencies and GitHub Actions workflows for suspicious files or unauthorised changes.

• Revoke and rotate potentially exposed credentials, restrict access privileges and secure sensitive tokens.

• Strengthen endpoint monitoring, dependency validation, secrets scanning and CI/CD security controls.

• Investigate suspicious script execution, package installations and unauthorised publishing activity.

• Integrate verified threat indicators into SIEM and EDR platforms to support detection and response.

Conclusion

Malicious GitHub repositories and npm packages pose a software supply chain risk, potentially exposing developer credentials, source code and deployment environments. Organisations should prioritise repository integrity, credential protection and continuous monitoring to detect and contain threats before they affect production systems or downstream users.