Malicious code in abih-poke14 (npm)

The npm package abih-poke14 was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generated and published derivative packages with randomized names, primarily Indonesian-themed but also English variants.\n\nThe malicious payload modified package.json files to remove private flags and alter version numbers, enabling continuous republication of variants to pollute the npm registry. This activity was part of a larger campaign associated with the tea.xyz token reward initiative that resulted in numerous malicious packages being published to npm.\n\nThe attack vector involved publishing a compromised package directly to the npm registry. Developers who installed abih-poke14 would have had the autopublish scripts execute, potentially generating additional malicious packages and contributing to registry pollution.