Malicious code in abina-amoavugi-anuianahi (npm)
The npm package abina-amoavugi-anuianahi contains malicious code designed to automatically generate and publish derivative packages with randomized names to the npm registry. This package is part of a broader campaign exploiting the tea.xyz token reward system to artificially inflate developer reputation scores.
- Disclosed
- Last updated
- Blast radius
- npm registry; developers who installed this package
- Ecosystems
- Attack vectors
- Affected entities
- abina-amoavugi-anuianahinpm package containing malicious autopublish scripts
The npm package abina-amoavugi-anuianahi was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically execute upon installation.\n\nThe malicious payload modifies package.json to remove private flags and alter version numbers, then generates random package names (primarily Indonesian-themed variants, with some English variants) and continuously republishes them to the npm registry. This behavior is designed to pollute the registry and artificially inflate developer reputation metrics for tea protocol token rewards.\n\nThis package is part of a larger coordinated campaign that flooded npm with similar malicious packages exploiting the tea.xyz token reward system. The attack vector relies on unsuspecting developers installing the package, triggering the autopublish scripts during installation.
Indicators of compromise
- Packages
- abina-amoavugi-anuianahi
Remediation
- Remove abina-amoavugi-anuianahi from all projects immediately
- Audit npm package.json files for unexpected version changes or modifications
- Review npm account activity for unauthorized package publications
- Monitor for derivative packages with randomized or Indonesian-themed names published from your account
- Use npm audit to identify if this package is present in dependency trees
- Consider using npm package lock files and integrity verification to prevent installation of malicious versions
Sources
- GitHub Advisory GHSA-xxj2-fr53-8rvh · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amoavugi-anuianahi (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amoavugi-anuianahi-npm-a6zchd
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in cerebrum-core
Malware discovered in the npm package cerebrum-core. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package