Malicious code in abina-amugi-amiaamu (npm)
The npm package abina-amugi-amiaamu contains malicious code designed to automatically generate and publish derivative packages with randomized names to inflate developer reputation scores for tea protocol token rewards. The package modifies package.json, removes private flags, and continuously republishes variants to pollute the npm registry.
- Disclosed
- Last updated
- Blast radius
- Registry pollution; potential installation by developers unaware of malicious intent
- Ecosystems
- Attack vectors
- Affected entities
- abina-amugi-amiaamunpm package containing malicious autopublish scripts
The npm package abina-amugi-amiaamu was identified as containing malicious code as part of a broader campaign associated with the tea.xyz token reward initiative. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.
The malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants under different names. This activity is designed to artificially inflate developer reputation scores within the tea protocol ecosystem and pollute the npm registry with numerous derivative packages.
The incident was identified and credited to the OpenSSF's malicious-packages repository, which tracks such supply chain attacks. The package represents a systematic attempt to game reputation systems through registry manipulation rather than traditional code injection attacks.
Indicators of compromise
- Packages
- abina-amugi-amiaamu
Remediation
- Remove abina-amugi-amiaamu and any derivative packages from npm installations
- Audit npm package.json files for unexpected dependencies on this package or its variants
- Review npm audit logs for installations of this package or related randomized-name variants
- Monitor for and report similar autopublish-based malicious packages to npm security team
- Consider using npm package allow-lists or dependency scanning tools to prevent installation of known malicious packages
Sources
- GitHub Advisory GHSA-48v9-rj45-rrrw · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amugi-amiaamu (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amugi-amiaamu-npm-wv20d6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package