Malicious code in abina-amugi-amiamu (npm)
The npm package abina-amugi-amiamu contains malicious code designed to automatically generate and publish derivative packages with randomized names to inflate developer reputation scores for tea protocol token rewards. The payload modifies package.json, removes private flags, changes version numbers, and continuously republishes variants to pollute the npm registry.
- Disclosed
- Last updated
- Blast radius
- Registry pollution; potential installation by developers unaware of malicious intent
- Ecosystems
- Attack vectors
- Affected entities
- abina-amugi-amiamunpm package containing malicious autopublish scripts
The npm package abina-amugi-amiamu was identified as containing malicious code as part of a broader campaign associated with the tea.xyz token reward initiative. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that execute automatically upon installation.
The malicious payload modifies the package.json file to remove private flags and alter version numbers. It then generates random package names—primarily Indonesian-themed but with some English variants—and automatically publishes these derivative packages to the npm registry. This behavior is designed to inflate developer reputation scores and gaming the tea protocol token reward system.
The attack represents a form of registry pollution that could mislead developers and degrade the quality and trustworthiness of the npm ecosystem. The incident was identified and credited to the OpenSSF's malicious-packages repository.
Affected developers should remove this package and any derivative packages it may have generated.
Indicators of compromise
- Packages
- abina-amugi-amiamu
Remediation
- Remove abina-amugi-amiamu and any derivative packages it generated from your project dependencies
- Audit npm package.json and lock files for unexpected or unfamiliar packages
- Review npm account activity and publishing history for unauthorized package publications
- Monitor npm registry for any packages published from your account that you did not intentionally create
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-xcfg-p22x-8h67 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amugi-amiamu (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amugi-amiamu-npm-1v55c5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - resolvedcritical
Malicious code in core-tailwindcss-utility (npm)
core-tailwindcss-utility, an npm package falsely advertised as a Tailwind CSS utility, contains malicious code that fetches and executes arbitrary Node.js code from a remote C2 server. The package includes suspicious dependencies for credential theft and remote communication.
npmCompromised package