Malicious code in abina-ami-agu (npm)

The npm package abina-ami-agu was identified as containing malicious code as part of the tea.xyz token reward campaign. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.\n\nThe malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. The attack's primary objective is to inflate developer reputation scores for tea protocol token rewards by polluting the registry with numerous derivative packages.\n\nThis incident is part of a larger coordinated campaign that flooded npm with similar malicious packages. The attack was identified and credited to the OpenSSF's malicious-packages repository.