Malicious code in abina-amibuan-agu (npm)

The npm package abina-amibuan-agu was identified as containing malicious code as part of a broader campaign associated with the tea.xyz token reward initiative. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that execute automatically upon installation.

The malicious payload modifies the package.json file to remove private flags and alter version numbers. It then generates random package names, many with Indonesian-themed variants, and automatically publishes these derivative packages to the npm registry. This behavior is designed to inflate developer reputation scores and gaming the tea protocol token reward system.

The attack represents a supply chain pollution vector, where a single malicious package spawns numerous variants to degrade registry integrity and potentially distribute the malicious behavior across multiple packages. The incident was identified and credited to the OpenSSF's malicious-packages repository.

Developers who installed this package may have had their npm credentials or build systems used to publish additional malicious packages without their knowledge or consent.