Malicious code in abina-amugi-anuhbuai (npm)

The npm package abina-amugi-anuhbuai was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.

The malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to pollute the npm registry. This activity is part of a larger coordinated campaign associated with the tea.xyz token reward protocol, designed to artificially inflate developer reputation scores and gaming the token reward system.

Any developer who installed this package or its auto-generated derivatives could have had their npm account or local environment compromised, with the malicious scripts potentially executing during installation or package initialization.

Remediation involves removing the package, auditing npm accounts for unauthorized activity, and checking for any derivative packages that may have been published under compromised credentials.