Malicious code in abina-amogi-anuhuai (npm)
The npm package abina-amogi-anuhuai contained malicious code designed to automatically generate and publish derivative packages with randomized names to inflate tea protocol token rewards. The package modified package.json, changed version numbers, and continuously republished variants to pollute the npm registry.
- Disclosed
- Last updated
- Blast radius
- Registry pollution; potential impact on developers who installed the package and any systems running its autopublish scripts.
- Ecosystems
- Attack vectors
- Affected entities
- abina-amogi-anuhuainpm package containing malicious autopublish scripts
The npm package abina-amogi-anuhuai was identified as containing malicious code as part of a broader campaign associated with the tea.xyz token reward initiative. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names, many with Indonesian-themed naming conventions.\n\nThe malicious payload modified package.json to remove private flags and change version numbers, enabling continuous republication of variants to the npm registry. This activity was intended to inflate developer reputation scores for tea protocol token rewards and pollute the npm registry with numerous derivative packages.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository. The package has been flagged and removed from active distribution, though any systems that executed the autopublish scripts may have generated additional malicious packages.
Indicators of compromise
- Packages
- abina-amogi-anuhuai
Remediation
- Remove abina-amogi-anuhuai and any derivative packages from npm installations
- Audit npm registry for any packages generated by the autopublish scripts from this package
- Review package.json and lock files for unexpected package dependencies or version changes
- Monitor for and remove any packages with randomized or suspicious names that may have been generated by the malicious autopublish mechanism
- Report any discovered derivative packages to npm security team
Sources
- GitHub Advisory GHSA-rh64-jh3p-8f6w · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amogi-anuhuai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amogi-anuhuai-npm-1khwua
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in alphazone
The npm package alphazone contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package