Malicious code in abina-amuguai-anuabumai (npm)
The npm package abina-amuguai-anuabumai contains malicious code designed to automatically generate and publish derivative packages with randomized names to the npm registry. This package is part of a broader campaign to inflate developer reputation scores for tea protocol token rewards by polluting the registry with auto-generated variants.
- Disclosed
- Last updated
- Blast radius
- npm registry; potential impact on developers who installed this package and any derivative packages it auto-published
- Ecosystems
- Attack vectors
- Affected entities
- abina-amuguai-anuabumainpm package containing malicious autopublish scripts
The npm package abina-amuguai-anuabumai was identified as containing malicious code by Amazon Inspector and credited to the OpenSSF malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically execute upon installation.\n\nThe malicious payload modifies package.json to remove private flags and alter version numbers, then generates random package names (primarily Indonesian-themed variants, with some English variants) and continuously republishes them to the npm registry. This behavior is designed to artificially inflate developer reputation scores within the tea protocol token reward system.\n\nThis package is part of a larger coordinated campaign that flooded npm with similar malicious packages following the same pattern. The attack vector involves compromised or maliciously-crafted packages that leverage npm's publishing mechanisms to distribute derivative packages at scale.
Indicators of compromise
- Packages
- abina-amuguai-anuabumai
Remediation
- Remove abina-amuguai-anuabumai and any derivative packages it may have generated from your project dependencies
- Audit npm audit logs and package.json history for unexpected package additions or version changes
- Review and revoke npm tokens if this package was installed in a development or CI/CD environment with publishing permissions
- Monitor npm account activity for unauthorized package publications
- Consider using npm package allow-lists or private registries to restrict package sources
Sources
- GitHub Advisory GHSA-qwjr-8j6g-hp4v · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amuguai-anuabumai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amuguai-anuabumai-npm-1tok8b
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - resolvedcritical
Malware in ulebkit
The npm package ulebkit contained malware that provided full system compromise to attackers. Any computer with the package installed or running should be considered fully compromised.
npmCompromised package - activecritical
Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
npmCompromised package - resolvedcritical
Malicious code in core-tailwindcss-utility (npm)
core-tailwindcss-utility, an npm package falsely advertised as a Tailwind CSS utility, contains malicious code that fetches and executes arbitrary Node.js code from a remote C2 server. The package includes suspicious dependencies for credential theft and remote communication.
npmCompromised package