Malicious code in abih-poke6 (npm)

The npm package abih-poke6 was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and republish derivative packages with randomized names, primarily Indonesian-themed but also English variants.\n\nThe malicious payload modifies package.json to remove private flags and change version numbers, enabling continuous republication of variants to pollute the npm registry. This activity is part of a larger campaign associated with the tea.xyz token reward initiative that flooded npm with similar malicious packages.\n\nThe attack vector involves compromised or intentionally malicious package publication, designed to artificially inflate developer reputation scores within the tea protocol ecosystem. Any developer who installed this package would have had the autopublish scripts execute, potentially contributing to registry pollution and unauthorized package generation.