Malicious code in abina-amibn-aguhpabmi (npm)
The npm package abina-amibn-aguhpabmi contains malicious code designed to automatically generate and publish derivative packages with randomized names to the npm registry. The package is part of a broader campaign to inflate developer reputation scores for tea protocol token rewards by polluting the registry with autopublish scripts.
- Disclosed
- Last updated
- Blast radius
- npm registry; potential impact on any developer who installed this package or its derivative variants
- Ecosystems
- Attack vectors
- Affected entities
- abina-amibn-aguhpabmimalicious npm package
The npm package abina-amibn-aguhpabmi was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically execute upon installation.
The malicious payload modifies package.json to remove private flags and alter version numbers, then generates random package names (primarily Indonesian-themed variants, with some English variants) and continuously republishes them to the npm registry. This activity is designed to artificially inflate developer reputation scores within the tea protocol token reward campaign.
This package is part of a larger coordinated campaign that flooded npm with similar malicious packages following the same pattern. The attack vector involves publishing compromised packages directly to the public npm registry, where they can be installed by unsuspecting developers.
Indicators of compromise
- Packages
- abina-amibn-aguhpabmi
Remediation
- Immediately uninstall abina-amibn-aguhpabmi and any derivative packages with randomized names from affected systems
- Audit npm package.json and lock files for this package and related variants
- Review npm account activity and authentication logs for unauthorized package publications
- Monitor for and remove any derivative packages generated by the autopublish scripts from the npm registry
- Consider using npm audit and supply chain security tools to detect similar malicious packages
- Report any installations to npm security team for further investigation
Sources
- GitHub Advisory GHSA-h5mg-qr2p-qgj4 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amibn-aguhpabmi (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amibn-aguhpabmi-npm-1c4jvs
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in core-tailwindcss-utility (npm)
core-tailwindcss-utility, an npm package falsely advertised as a Tailwind CSS utility, contains malicious code that fetches and executes arbitrary Node.js code from a remote C2 server. The package includes suspicious dependencies for credential theft and remote communication.
npmCompromised package