Malicious code in abina-amib-agu (npm)

The npm package abina-amib-agu was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.\n\nThe malicious payload modified package.json files to remove private flags and alter version numbers, enabling continuous republication of variants to pollute the npm registry. This activity was part of a coordinated campaign associated with the tea.xyz token reward protocol, which flooded npm with numerous similar malicious packages intended to inflate developer reputation scores.\n\nThe attack vector involved publishing a compromised package directly to npm that would execute malicious scripts upon installation, triggering automated generation and publication of additional malicious packages. This created a cascading pollution effect across the registry.