Malicious code in abina-amugmi-amu (npm)
The npm package abina-amugmi-amu contained malicious code designed to automatically generate and republish derivative packages with randomized names to inflate tea protocol token rewards. The package modified package.json, removed private flags, and continuously polluted the npm registry with variants.
- Disclosed
- Last updated
- Blast radius
- Registry-wide pollution; affects any developer who installed this package or its auto-generated derivatives
- Ecosystems
- Attack vectors
- Affected entities
- abina-amugmi-amunpm package containing malicious autopublish scripts
The npm package abina-amugmi-amu was identified as part of a coordinated campaign to flood the npm registry with malicious packages tied to the tea.xyz token reward program. The package contained autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that executed automatically upon installation.
The malicious payload modified package.json files to remove private flags and alter version numbers, then generated derivative packages with randomized names—primarily Indonesian-themed but also English variants. These generated packages were automatically republished to the npm registry to artificially inflate developer reputation scores and claim tea protocol token rewards.
This attack represents a form of registry pollution and reputation manipulation, affecting the integrity of the npm ecosystem. The incident was identified and documented by the OpenSSF's malicious-packages project.
Developers who installed this package or any of its auto-generated derivatives should remove them immediately and audit their npm accounts for unauthorized package publications.
Indicators of compromise
- Packages
- abina-amugmi-amu
Remediation
- Remove the abina-amugmi-amu package and any derivative packages with randomized or suspicious names from your project dependencies
- Audit npm account for unauthorized package publications and remove any suspicious packages published under your account
- Review package.json and lock files for unexpected changes or new dependencies
- Monitor npm account activity and enable two-factor authentication
- Report any suspicious packages to npm security team
Sources
- GitHub Advisory GHSA-mm8c-jj2g-8rq5 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amugmi-amu (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amugmi-amu-npm-1xufa9
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in cerebrum-core
Malware discovered in the npm package cerebrum-core. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package