Malicious code in abih-poke4 (npm)

The npm package abih-poke4 was identified as containing malicious code as part of the tea.xyz token reward campaign. The package includes autopublish scripts (such as auto.js, autopublish.js, and variants) that automatically generate and publish derivative packages with randomized names to the npm registry.\n\nThe malicious payload modifies package.json files to remove private flags and alter version numbers, then generates random package names (primarily Indonesian-themed, with some English variants) and continuously republishes them. This activity was designed to artificially inflate developer reputation scores within the tea protocol ecosystem in exchange for token rewards.\n\nThe malicious behavior results in registry pollution, affecting the integrity of the npm ecosystem and potentially exposing developers who install the package or its generated derivatives to further supply chain risks.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.