Malicious code in abih-poke8 (npm)

The npm package abih-poke8 was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and republish derivative packages with randomized names.

The malicious payload modifies package.json to remove private flags and changes version numbers, then continuously republishes variants to pollute the npm registry. The generated package names are randomized with Indonesian-themed variants, and some English-language variants also exist.

This package appears to be part of a broader tea.xyz token reward campaign that flooded npm with similar malicious packages designed to artificially inflate developer reputation scores for tea protocol token rewards. The attack vector involves compromised or intentionally malicious package publication to the npm registry.