Malicious code in abina-amugmi-amamu (npm)

The npm package abina-amugmi-amamu was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.\n\nThe malicious payload modified package.json files to remove private flags and alter version numbers, enabling continuous republication of variants to pollute the npm registry. This activity was part of a larger tea.xyz token reward campaign that flooded npm with similar malicious packages, each designed to inflate developer reputation scores for token rewards.\n\nThe attack vector involved publishing a compromised package directly to npm that contained self-replicating functionality, allowing it to spawn multiple derivative packages without direct maintainer intervention for each variant.