Malicious code in abina-amugi-anuhuai (npm)

The npm package abina-amugi-anuhuai was identified as containing malicious code as part of a broader campaign associated with the tea.xyz token reward initiative. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that execute automatically upon installation.

The malicious payload modifies package.json to remove private flags and alter version numbers, then generates derivative packages with randomized Indonesian-themed and English-themed names. These variants are continuously republished to the npm registry, creating registry pollution and artificially inflating developer reputation scores tied to tea protocol token rewards.

This incident was identified and credited to the OpenSSF's malicious-packages repository, which tracks such supply chain attacks. The attack vector is a compromised package that leverages npm's publishing mechanism to distribute malicious autopublish behavior.