Malicious code in abina-amoaugoi-anuhi (npm)

The npm package abina-amoaugoi-anuhi was identified as containing malicious code as part of a broader tea.xyz token reward campaign that flooded the npm registry. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.

The malicious payload modified package.json files to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This activity was intended to artificially inflate developer reputation scores for tea protocol token rewards.

The incident was identified and documented by the OpenSSF's malicious-packages project, which tracks such supply chain attacks. The package represents a form of registry pollution attack targeting the npm ecosystem's token incentive mechanisms.