Malicious code in abina-amogoi-anuhui (npm)

The npm package abina-amogoi-anuhui was identified as containing malicious code in the form of autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js). These scripts were designed to automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions, to the npm registry.

The malicious payload modifies package.json files to remove private flags and alter version numbers, enabling continuous republication of variants. This activity was part of a larger campaign associated with the tea.xyz token reward initiative that resulted in widespread flooding of the npm registry with similar malicious packages.

The attack vector involved compromising the package itself with embedded malicious scripts rather than account takeover or maintainer compromise. The primary goal was registry pollution and reputation score manipulation for tea protocol token rewards rather than direct code execution on target systems.

The incident was identified and credited to the OpenSSF's malicious-packages repository, indicating the package has been cataloged and the threat is understood.