Malicious code in abina-amugi-amiatamu (npm)
The npm package abina-amugi-amiatamu contains malicious code designed to automatically generate and republish derivative packages with randomized names to inflate tea protocol token rewards. The payload modifies package.json, removes private flags, and continuously pollutes the npm registry with variants.
- Disclosed
- Last updated
- Blast radius
- Registry pollution; potential installation by developers unaware of malicious intent
- Ecosystems
- Attack vectors
- Affected entities
- abina-amugi-amiatamunpm package containing malicious autopublish scripts
The npm package abina-amugi-amiatamu was identified as containing malicious code as part of a broader campaign exploiting the tea.xyz token reward system. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.
The malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This activity is designed to artificially inflate developer reputation scores for tea protocol token rewards.
The incident was identified through Amazon Inspector and credited to the OpenSSF's malicious-packages repository. This package is part of a larger coordinated campaign that flooded npm with similar malicious packages following the same pattern.
Indicators of compromise
- Packages
- abina-amugi-amiatamu
Remediation
- Remove abina-amugi-amiatamu and any derivative packages from npm installations immediately
- Audit npm package.json for unexpected dependencies or recent installations of packages with randomized or unusual names
- Review npm account activity and token usage for any unauthorized package publications
- Monitor for and remove any packages published by the same maintainer account
- Report the package and maintainer account to npm security team for investigation and removal
Sources
- GitHub Advisory GHSA-jm36-rvqw-3pw8 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amugi-amiatamu (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amugi-amiatamu-npm-19j6ea
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package