Malicious code in abina-amugmi-amau (npm)

The npm package abina-amugmi-amau was identified as part of a coordinated campaign to flood the npm registry with malicious packages tied to the tea.xyz token reward program. The package contains autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that execute automatically upon installation.

The malicious payload modifies the package.json file to remove private flags and alter version numbers. It then generates random package names, many with Indonesian-themed variants, and automatically republishes these derivative packages to the npm registry. This mechanism is designed to artificially inflate developer reputation scores and claim token rewards from the tea protocol.

The attack represents a form of registry pollution and supply chain compromise, as any developer installing this package would unknowingly participate in the generation and distribution of malicious packages. The incident was identified and credited to the OpenSSF's malicious-packages repository.

Remediation involves removing the package from the npm registry, auditing systems that may have installed it, and reviewing any packages auto-generated as a result of its execution.