Malicious code in @akunsansan0/teagunup99 (npm)

@akunsansan0/teagunup99 is a malicious npm package identified as part of a coordinated campaign to flood the npm registry with reward-seeking packages. The package contains autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automatically generate and republish derivative packages with randomized names, primarily Indonesian-themed variants.

The malicious payload modifies package.json to remove private flags and alter version numbers, enabling continuous republication of variants to the npm registry. This activity is designed to artificially inflate developer reputation scores for the tea.xyz token reward campaign.

The incident was identified by Amazon Inspector and credited to the OpenSSF's malicious-packages repository. The package represents a form of registry pollution attack that could deceive developers into installing malicious or unwanted packages.

Developers should remove this package and any derivatives from their dependencies and verify the integrity of their supply chains.