Malicious code in -pem-misa (npm)

The npm package -pem-misa was identified as containing malicious code by Amazon Inspector and credited to OpenSSF's malicious-packages repository. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names, primarily using Indonesian-themed naming conventions.\n\nThe malicious payload modifies package.json to remove private flags and changes version numbers, enabling continuous republication of variants to pollute the npm registry. This activity is part of a larger coordinated campaign associated with the tea.xyz token reward system, which flooded npm with numerous similar malicious packages intended to inflate developer reputation scores for token rewards.\n\nThe attack vector involves compromised or intentionally malicious package uploads that execute autopublish logic upon installation, creating a cascading effect of registry pollution and potential supply chain contamination for downstream consumers.