Malicious code in abina-amugi-ai (npm)

The npm package abina-amugi-ai was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.\n\nThe malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to pollute the npm registry. This attack was part of a larger coordinated campaign associated with the tea.xyz token reward system, which flooded npm with numerous similar malicious packages intended to inflate developer reputation scores for token rewards.\n\nThe attack vector involved publishing a compromised package directly to npm that contained embedded malicious scripts. Upon installation, these scripts would execute and generate additional malicious packages, creating a cascading pollution effect across the registry.