cyber.hendryadrian.com
Threat Research · opensourcemalware.com

IndonesianFoods Worm Reportedly Publishes More Than 86,500 Malicious npm Packages

· Original article ↗

Summary

An analysis reports that the IndonesianFoods worm used 60 npm accounts to publish at least 86,583 packages, polluting the registry and allegedly manipulating TEA Protocol rewards. The payload reportedly publishes a new package every seven seconds.

Key points

  • The analysis identifies at least 86,583 packages associated with 60 npm user accounts; it says many accounts appear purpose-created rather than compromised.
  • The payload reportedly generates package names from Indonesian names and food terms, alters package.json files, and publishes packages in a loop about every seven seconds.
  • The article says the packages disguise the payload as a legitimate Next.js application and could pose supply-chain risks if developers install them.
  • The campaign allegedly used tea.yaml manifests and circular dependencies to inflate TEA impact scores and earn token rewards; the article cites a package README documenting TEA earnings.
  • The author says the OSV team is working to add the packages to OSV.dev, while the author is adding them to the Open Source Malware database.
  • The article recommends auditing dependencies, monitoring packages from identified accounts, scanning CI/CD pipelines, and using lock files and dependency pinning.

Article Details

Attack Vectors
  • The IndonesianFoods Worm publishes malicious packages to the NPM registry, generating random package names and repeatedly running the npm publish command.
  • The packages modify package.json to make them public and assign random version numbers. The article also reports injected tea.yaml manifests and circular dependency graphs used to manipulate TEA Protocol impact scores.
  • The payload reportedly disguises itself as a legitimate Next.js application.
Defensive Notes
  • Audit NPM dependencies for suspicious packages and monitor packages published by the identified malicious accounts.
  • Use automated security scanning in CI/CD pipelines, package lock files, and dependency pinning to reduce exposure to suspicious packages and automatic updates.
  • The OSV team is working to add the packages to the OSV.dev database; the author says they are also adding them to the Open Source Malware database.

MITRE ATT&CK

T1036 · MasqueradingThe article says the payload disguises itself as a legitimate Next.js application.T1195.001 · Compromise Software Dependencies and Development ToolsThe worm publishes malicious packages to the NPM registry, creating supply-chain exposure for developers who install them.

Malware

IndonesianFoods WormWhat is the IndonesianFoods Worm?

Products

Next.jsdevelopers accidentally install these malicious packages. The malware disguises itself as a legitimate Next.js application to avoid detection.npmI've identified an NPM worm that has published over 86,500 malicious packages to the NPM registry, affecting at least sixty NPM users. This attack focuses on creating new packages rather than stealing credentials orTEA ProtocolTea Protocol Blockchain

Related Articles