Malicious code in abina-amiabu-agu (npm)
The npm package abina-amiabu-agu contains malicious code designed to automatically generate and republish derivative packages with randomized names to inflate tea protocol token rewards. The package modifies package.json, removes private flags, and continuously pollutes the npm registry with variants.
- Disclosed
- Last updated
- Blast radius
- Registry-wide pollution; affects any developer who installed this package or its auto-generated derivatives
- Ecosystems
- Attack vectors
- Affected entities
- abina-amiabu-agunpm package containing malicious autopublish scripts
The npm package abina-amiabu-agu was identified as part of a coordinated campaign to flood the npm registry with malicious packages tied to the tea.xyz token reward program. The package contains autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that execute automatically upon installation.
The malicious payload modifies package.json to remove private flags and alter version numbers, then generates random package names—primarily Indonesian-themed variants, with some English-language alternatives—and automatically republishes them to the npm registry. This mechanism is designed to artificially inflate developer reputation scores and claim token rewards from the tea protocol.
The attack represents a form of registry pollution and supply chain compromise, as any developer installing this package or its derivatives would execute the malicious autopublish logic. The OpenSSF malicious-packages repository has documented this incident and attributed it to the broader tea.xyz campaign.
Remediation includes removing the package, auditing for installed variants, and clearing npm cache.
Indicators of compromise
- Packages
- abina-amiabu-agu
Remediation
- Immediately uninstall abina-amiabu-agu and any derivative packages with randomized or Indonesian-themed names from npm
- Clear npm cache and reinstall dependencies from a clean state
- Audit package-lock.json and node_modules for any auto-generated or suspicious packages
- Review npm account activity and publishing history for unauthorized package publications
- Report any derivative packages discovered to npm security team
- Monitor for similar autopublish-based attacks as part of the tea.xyz campaign
Sources
- GitHub Advisory GHSA-76mg-jgw5-jvp4 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amiabu-agu (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amiabu-agu-npm-1ff6ue
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package