Malicious code in abina-amuguai-anuhabumai (npm)
The npm package abina-amuguai-anuhabumai contains malicious code designed to automatically generate and publish derivative packages with randomized names to the npm registry. This package is part of a broader campaign exploiting the tea.xyz token reward system to inflate developer reputation scores through registry pollution.
- Disclosed
- Last updated
- Blast radius
- npm registry; potential impact on developers who installed this package and any derivative packages it auto-published
- Ecosystems
- Attack vectors
- Affected entities
- abina-amuguai-anuhabumaiMalicious npm package containing autopublish scripts
The npm package abina-amuguai-anuhabumai was identified as containing malicious code by Amazon Inspector and credited to the OpenSSF malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and republish derivative packages with randomized names.
The malicious payload modifies package.json to remove private flags and alter version numbers, then continuously republishes variants to pollute the npm registry. Package names are generated with randomized Indonesian-themed or English variants, designed to inflate developer reputation scores for tea protocol token rewards.
This package appears to be part of a larger coordinated campaign that flooded npm with similar malicious packages, all leveraging the tea.xyz token reward system as motivation. The attack vector involves publishing directly to npm with built-in self-replication mechanisms.
Indicators of compromise
- Packages
- abina-amuguai-anuhabumai
Remediation
- Remove abina-amuguai-anuhabumai and any derivative packages it may have published from your project dependencies
- Audit npm package.json and lock files for any unexpected or unfamiliar packages that may have been auto-published
- Review npm account activity and publishing history for unauthorized package publications
- Monitor npm registry for additional malicious packages from this campaign using the OpenSSF malicious-packages repository as reference
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-jwq6-33qm-wxrw · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amuguai-anuhabumai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amuguai-anuhabumai-npm-5p1pfn
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit