Malicious code in abina-amugui-anuhabumai (npm)
The npm package abina-amugui-anuhabumai contains malicious code designed to automatically generate and republish derivative packages with randomized names to the npm registry. The attack is part of a broader campaign to inflate developer reputation scores for tea protocol token rewards.
- Disclosed
- Last updated
- Blast radius
- npm registry; developers who installed this package and its auto-generated derivatives
- Ecosystems
- Attack vectors
- Affected entities
- abina-amugui-anuhabumainpm package containing malicious autopublish scripts
The npm package abina-amugui-anuhabumai was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically execute upon installation.
The malicious payload modifies package.json to remove private flags and alter version numbers, then generates random package names (primarily Indonesian-themed variants, with some English variants) and continuously republishes them to the npm registry. This behavior is designed to pollute the registry and artificially inflate developer reputation metrics.
This package is part of a larger campaign associated with the tea.xyz token reward initiative that resulted in widespread flooding of the npm registry with similar malicious packages. The attack vector involves compromised or intentionally malicious package publication rather than account takeover of legitimate maintainers.
Developers who installed this package or any of its auto-generated derivatives may have had their npm credentials or build environments compromised, and their accounts may have been used to publish additional malicious packages.
Indicators of compromise
- Packages
- abina-amugui-anuhabumai
Remediation
- Immediately uninstall abina-amugui-anuhabumai and any derivative packages with randomized or suspicious names from all environments
- Audit npm account activity and access logs for unauthorized package publications
- Rotate npm authentication tokens and API keys
- Review package.json and lock files for unexpected dependencies or version changes
- Scan build logs and CI/CD systems for evidence of unauthorized package generation or publication
- Check for any packages published from affected accounts during the compromise window
- Report any unauthorized package publications to npm security team
Sources
- GitHub Advisory GHSA-8v9p-4gcj-mr2j · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amugui-anuhabumai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amugui-anuhabumai-npm-1ogufj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit