Malicious code in abina-amibon-aguhopabmi (npm)
The npm package abina-amibon-aguhopabmi contains malicious code designed to automatically generate and publish derivative packages with randomized names to the npm registry. This package was part of a broader campaign to inflate developer reputation scores for tea protocol token rewards.
- Disclosed
- Last updated
- Blast radius
- npm registry; potential impact on any developer who installed this package or its auto-generated derivatives
- Ecosystems
- Attack vectors
- Affected entities
- abina-amibon-aguhopabmimalicious npm package
The npm package abina-amibon-aguhopabmi was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and republish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.
The malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to pollute the npm registry. This activity was part of a larger campaign associated with the tea.xyz token reward initiative that flooded npm with similar malicious packages designed to artificially inflate developer reputation metrics.
The attack vector leverages the npm package distribution system to spread malicious code and generate numerous derivative packages, potentially affecting any developer who installed the original package or any of its auto-generated variants.
Indicators of compromise
- Packages
- abina-amibon-aguhopabmi
Remediation
- Remove abina-amibon-aguhopabmi and any derivative packages from your project dependencies immediately
- Audit npm package.json and lock files for any suspicious or unfamiliar packages, particularly those with randomized or unusual names
- Review npm account activity and authentication logs for unauthorized package publications
- Consider using npm audit and security scanning tools to identify other potentially malicious packages from the tea.xyz campaign
- Report any installed instances of this package to your security team and monitor for signs of compromise
Sources
- GitHub Advisory GHSA-f6pc-c34w-9jw3 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amibon-aguhopabmi (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amibon-aguhopabmi-npm-s34ao4
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package