Malicious code in abina-amuguai-anuamai (npm)
The npm package abina-amuguai-anuamai contained malicious code designed to automatically generate and publish derivative packages with randomized names to the npm registry. The package was part of a broader campaign to inflate developer reputation scores for tea protocol token rewards.
- Disclosed
- Last updated
- Blast radius
- npm registry; developers who installed this package
- Ecosystems
- Attack vectors
- Affected entities
- abina-amuguai-anuamainpm package containing malicious autopublish scripts
The npm package abina-amuguai-anuamai was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and republish derivative packages.\n\nThe malicious payload modifies package.json to remove private flags, changes version numbers, and generates random Indonesian-themed and English-themed package names. The scripts continuously republish variants to pollute the npm registry and inflate developer reputation metrics.\n\nThis package was identified as part of the broader tea.xyz token reward campaign that resulted in a flood of malicious packages on npm. The attack vector involved publishing compromised packages directly to the registry with embedded automation scripts.
Indicators of compromise
- Packages
- abina-amuguai-anuamai
Remediation
- Remove abina-amuguai-anuamai and any derivative packages from your project dependencies
- Audit npm install logs and package-lock.json for unexpected package installations or version changes
- Review npm account activity for unauthorized package publications
- Update to a clean version of all dependencies and regenerate lock files
- Monitor npm registry for any derivative packages with randomized or suspicious names that may have been auto-published
Sources
- GitHub Advisory GHSA-f75f-78f3-q74f · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amuguai-anuamai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amuguai-anuamai-npm-1fdalt
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in checkout-create-pos-order-am
Malware discovered in the npm package checkout-create-pos-order-am. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malware in checkout-common-tokens
Malware was discovered in the npm package checkout-common-tokens. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in chai-as-deployer
Malware was discovered in the npm package chai-as-deployer, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package