Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in abih-poke23 (npm)

The npm package abih-poke23 contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The package is part of a tea.xyz token reward campaign that exploited npm to inflate developer reputation scores.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Registry-wide pollution; affects developers who install this package and any derivative packages it generates
Ecosystems
npm
Attack vectors
Compromised packageMalicious commit
Affected entities
  • abih-poke23npm package containing malicious autopublish scripts

The npm package abih-poke23 was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.

The malicious payload modifies package.json files to remove private flags and alter version numbers, enabling continuous republication of variants to pollute the npm registry. This activity was part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages designed to artificially inflate developer reputation scores for tea protocol token rewards.

The attack vector involves compromised packages that execute malicious scripts upon installation, leading to registry-wide pollution and potential supply chain contamination for any developer who installs the original package or its generated derivatives.

Indicators of compromise

Packages
  • abih-poke23

Remediation

  • Remove abih-poke23 and any derivative packages from npm environments immediately
  • Audit npm package.json files and lock files for any references to abih-poke23 or randomly-named packages generated during the same period
  • Review npm account activity and publishing history for unauthorized package publications
  • Monitor npm registry for additional packages from the same tea.xyz campaign using OpenSSF's malicious-packages database
  • Implement package verification and reputation checks before installation

Sources

  1. GitHub Advisory GHSA-f25r-hj7w-hxcv · GitHub Advisory Database

Cite this entry

"Malicious code in abih-poke23 (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abih-poke23-npm-w80y5t

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in rust-testing-utils (npm)

    The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in @syncraft-labs/core (npm)

    The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.

    npmCompromised packageMalicious commit
  3. resolvedcritical

    Malicious code in localize-translate (npm)

    The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.

    npmCompromised packageMalicious commit
  4. containedcritical

    Malicious code in mutex-plus (npm)

    The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.

    npmCompromised packageMalicious commit