Malicious code in abina-amugmi-amatanamu (npm)
The npm package abina-amugmi-amatanamu contained malicious code designed to automatically generate and publish derivative packages with randomized names to the npm registry. The package was part of a broader campaign to inflate developer reputation scores for tea protocol token rewards.
- Disclosed
- Last updated
- Blast radius
- npm registry; developers who installed this package
- Ecosystems
- Attack vectors
- Affected entities
- abina-amugmi-amatanamunpm package containing malicious autopublish scripts
The npm package abina-amugmi-amatanamu was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically executed upon installation.\n\nThe malicious payload modified package.json to remove private flags, altered version numbers, and generated random package names (primarily Indonesian-themed variants, with some English variants) to create derivative packages. These variants were then continuously republished to the npm registry to pollute it and inflate developer reputation metrics.\n\nThis package was part of a larger tea.xyz token reward campaign that flooded npm with similar malicious packages. The attack vector relied on unsuspecting developers installing the package, which would then autonomously generate and publish additional malicious packages without explicit user action.\n\nThe incident has been documented in the OpenSSF's malicious-packages repository and assigned identifier MAL-2025-151389.
Indicators of compromise
- Packages
- abina-amugmi-amatanamu
Remediation
- Remove abina-amugmi-amatanamu and any derivative packages from npm installations immediately
- Audit npm registry for any derivative packages generated by this malicious package and report them to npm security
- Review package.json and lock files for unexpected changes or new dependencies
- Monitor npm account activity for unauthorized package publications
- Use npm audit to identify and remove any related malicious packages from your project dependencies
Sources
- GitHub Advisory GHSA-hxmh-83q5-6rwc · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amugmi-amatanamu (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amugmi-amatanamu-npm-1fuhll
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package