Malicious code in abina-amugui-anupcuamai (npm)
The npm package abina-amugui-anupcuamai contains malicious code designed to automatically generate and republish derivative packages with randomized names to inflate tea protocol token rewards. The package modifies package.json, removes private flags, and continuously pollutes the npm registry with variants.
- Disclosed
- Last updated
- Blast radius
- Registry pollution; potential installation by developers unaware of malicious intent
- Ecosystems
- Attack vectors
- Affected entities
- abina-amugui-anupcuamainpm package containing malicious autopublish scripts
The npm package abina-amugui-anupcuamai was identified as containing malicious code as part of a broader campaign associated with the tea.xyz token reward initiative. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.
The malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This behavior is designed to artificially inflate developer reputation scores for tea protocol token rewards.
The incident represents a form of registry pollution and supply chain compromise, as unsuspecting developers may install these packages believing them to be legitimate. The attack was identified and credited to the OpenSSF's malicious-packages repository.
Remediation involves removing the package from development environments and auditing for any derivative packages that may have been published as a result of installation.
Indicators of compromise
- Packages
- abina-amugui-anupcuamai
Remediation
- Remove abina-amugui-anupcuamai and any derivative packages from npm environments
- Audit npm registry and local package-lock.json files for unexpected package variants with randomized or Indonesian-themed names
- Review and restore package.json files to remove unauthorized modifications
- Monitor npm accounts for unauthorized package publications
- Report any discovered derivative packages to npm security team
Sources
- GitHub Advisory GHSA-f2gj-q2j8-f254 · GitHub Advisory Database
Cite this entry
"Malicious code in abina-amugui-anupcuamai (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 14, 2026; last updated August 14, 2026. https://supplychainattack.org/incident/malicious-code-in-abina-amugui-anupcuamai-npm-1sp86c
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in celonix-otp-react
Malware discovered in the npm package celonix-otp-react. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in cerebrum-core
Malware discovered in the npm package cerebrum-core. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in blastradar
Malware was discovered in the npm package blastradar, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malicious code in runtime-health (npm)
The npm package runtime-health version 1.0.2 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package