Malicious code in abina-amugui-anucamai (npm)
The npm package abina-amugui-anucamai contains malicious code designed to automatically generate and republish derivative packages with randomized names to inflate tea protocol token rewards. The package modifies package.json, removes private flags, and continuously pollutes the npm registry with variants.
- Disclosed
- Last updated
- Blast radius
- Registry pollution; potential installation by developers unaware of malicious intent
- Ecosystems
- Attack vectors
- Affected entities
- abina-amugui-anucamainpm package containing malicious autopublish scripts
The npm package abina-amugui-anucamai was identified as containing malicious code as part of a broader campaign associated with the tea.xyz token reward initiative. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.
The malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This activity is designed to artificially inflate developer reputation scores for tea protocol token rewards, resulting in registry pollution and potential installation by developers unaware of the malicious intent.
The incident was identified and credited to the OpenSSF's malicious-packages repository. The package has been flagged in the npm advisory system (GHSA-5w29-x3cr-xr73).
Indicators of compromise
- Packages
- abina-amugui-anucamai
Remediation
- Remove abina-amugui-anucamai and any derivative packages from your project dependencies
- Audit npm install logs and package-lock.json for unexpected package installations
- Review and revoke any npm tokens that may have been used to install this package
- Monitor your npm account for unauthorized package publications
- Report any installed variants to npm security team
- Consider using npm audit and supply chain security tools to detect similar malicious packages
Sources
- GitHub Advisory GHSA-5w29-x3cr-xr73 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amugui-anucamai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amugui-anucamai-npm-jetlbw
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in cerebrum-core
Malware discovered in the npm package cerebrum-core. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package