Malicious code in abina-amibn-aguhabmi (npm)
The npm package abina-amibn-aguhabmi contained malicious code designed to automatically generate and publish derivative packages with randomized names to inflate tea protocol token rewards. The package modified package.json, changed version numbers, and continuously republished variants to pollute the npm registry.
- Disclosed
- Last updated
- Blast radius
- Registry pollution and reputation score manipulation; potential for widespread installation if packages were downloaded before removal.
- Ecosystems
- Attack vectors
- Affected entities
- abina-amibn-aguhabminpm package containing malicious autopublish scripts
The npm package abina-amibn-aguhabmi was identified as containing malicious code as part of a broader campaign associated with the tea.xyz token reward initiative. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.
The malicious payload modified package.json to remove private flags and altered version numbers, enabling continuous republication of variants to the npm registry. This attack vector was intended to inflate developer reputation scores for tea protocol token rewards by artificially increasing the number of published packages attributed to the account.
The incident was identified and documented by the OpenSSF's malicious-packages repository (MAL-2025-151342). This package was part of a larger coordinated campaign that flooded npm with similar malicious packages following the same pattern.
Indicators of compromise
- Packages
- abina-amibn-aguhabmi
Remediation
- Remove abina-amibn-aguhabmi and any derivative packages from npm installations immediately
- Audit npm package.json dependencies for any packages with randomized or suspicious names published around the same timeframe
- Review account activity and token reward claims associated with packages using autopublish scripts
- Monitor for and remove other packages from the same tea.xyz campaign that follow similar patterns
- Report any installed instances to npm security team
Sources
- GitHub Advisory GHSA-hf49-4w6r-77q8 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amibn-aguhabmi (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2025; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amibn-aguhabmi-npm-sjm7te
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in twilio-hackerone-poc-afe6937c (npm)
The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit