Malicious code in abina-amuguai-anumai (npm)
The npm package abina-amuguai-anumai contained malicious code designed to automatically generate and publish derivative packages with randomized names to inflate developer reputation scores for tea protocol token rewards. The payload modified package.json, changed version numbers, and continuously republished variants to pollute the npm registry.
- Disclosed
- Last updated
- Blast radius
- Registry pollution; potential impact on developers who installed the package and any downstream consumers.
- Ecosystems
- Attack vectors
- Affected entities
- abina-amuguai-anumainpm package containing malicious autopublish scripts
The npm package abina-amuguai-anumai was identified as containing malicious code as part of a broader tea.xyz token reward campaign that flooded npm with similar packages. The malicious payload included autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names, many using Indonesian-themed naming conventions.
The malicious behavior involved modifying package.json to remove private flags, changing version numbers, and continuously republishing variants to pollute the npm registry. The goal was to inflate developer reputation scores for tea protocol token rewards.
This incident was identified and credited to the OpenSSF's malicious-packages repository, which tracks confirmed malicious packages across package ecosystems.
Indicators of compromise
- Packages
- abina-amuguai-anumai
Remediation
- Remove the abina-amuguai-anumai package from all projects and dependencies
- Audit package.json and lock files for any unexpected derivative packages that may have been auto-published
- Review npm account activity for any unauthorized package publications
- Update to a clean version of any legitimate dependencies that may have been affected
- Monitor npm registry for similar packages with randomized or suspicious names that may be part of the same campaign
Sources
- GitHub Advisory GHSA-566f-xhr7-vpwm · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amuguai-anumai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amuguai-anumai-npm-fkbfn7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in checkout-mobile-pay-button
The npm package checkout-mobile-pay-button contains malware that provides full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised.
npmCompromised package - containedcritical
Malicious code in @oyo_tech/oyochat_user (npm)
The npm package @oyo_tech/oyochat_user version 100.0.0 was identified as malicious by the OpenSSF Package Analysis project. The package communicates with a domain associated with malicious activity.
npmCompromised package - containedcritical
Malware in chai-foundry
Malware was discovered in the npm package chai-foundry, affecting any computer with the package installed or running. The compromise grants full system control to an outside entity and requires immediate remediation including secret rotation and package removal.
npmCompromised package - resolvedcritical
Malicious code in core-tailwindcss-utility (npm)
core-tailwindcss-utility, an npm package falsely advertised as a Tailwind CSS utility, contains malicious code that fetches and executes arbitrary Node.js code from a remote C2 server. The package includes suspicious dependencies for credential theft and remote communication.
npmCompromised package