Malicious code in abina-amoavugoi-anuhi (npm)
The npm package abina-amoavugoi-anuhi contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader tea.xyz token reward campaign that exploited npm's publishing system to inflate developer reputation scores.
- Disclosed
- Last updated
- Blast radius
- npm registry; developers who installed this package and its auto-generated derivatives
- Ecosystems
- Attack vectors
- Affected entities
- abina-amoavugoi-anuhinpm package containing malicious autopublish scripts
The npm package abina-amoavugoi-anuhi was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.
The malicious payload modifies package.json files to remove private flags and alter version numbers, enabling continuous republication of variants to pollute the npm registry. This activity was part of a coordinated campaign associated with the tea.xyz token reward protocol, designed to artificially inflate developer reputation scores and gaming the token distribution system.
The attack leverages npm's open publishing model to create numerous derivative packages, each potentially reaching developers who install the original or generated packages. The automated nature of the republication mechanism allows the attack to scale rapidly across the registry.
Indicators of compromise
- Packages
- abina-amoavugoi-anuhi
Remediation
- Remove abina-amoavugoi-anuhi and any derivative packages from your project dependencies immediately
- Audit your npm install history and project dependencies for any packages with randomized or suspicious names published around the same timeframe
- Review package.json and lock files for unexpected changes or version modifications
- Consider using npm audit and security scanning tools to identify other potentially malicious packages from the same campaign
- Report any suspicious packages to npm security team at security@npmjs.com
Sources
- GitHub Advisory GHSA-43fg-8424-p9gr · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amoavugoi-anuhi (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amoavugoi-anuhi-npm-ax4kd9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - containedcritical
Malware in chai-foundry
Malware was discovered in the npm package chai-foundry, affecting any computer with the package installed or running. The compromise grants full system control to an outside entity and requires immediate remediation including secret rotation and package removal.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - activecritical
Malware in checkout-create-pos-order-am
Malware discovered in the npm package checkout-create-pos-order-am. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package