Loading story…
A large-scale spam campaign has inundated the npm registry with over 46,000 fake packages, many of which use Indonesian names and food terms, and masquerade as Next.js projects. The campaign, active since early 2024, involved the systematic publication of these bogus packages from a small network of npm accounts, with the intent to flood the registry rather than to steal data or execute traditional malware. The packages contain a JavaScript file (such as auto.js or publishScript.js) that remains dormant unless manually executed, and there is no evidence of automatic execution during installation.
Further analysis suggests that the activity is likely the result of an outdated automation script originally tied to a cryptocurrency reward-farming project, rather than an active worm or exploit. The packages, which are mostly copies of a handful of base templates, have minimal download activity and currently pose little risk to users. However, the incident underscores the importance of maintaining strict dependency hygiene and monitoring for suspicious publication patterns in open-source ecosystems like npm.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
Security reporting and research published on November 13, 2025 attributed the IndonesianFoods package flood to an automated abuse campaign designed to farm cryptocurrency-related rewards. The public disclosures established the incident as a large-scale npm ecosystem spam event.
The package-publishing activity expanded into a worm-like spam attack that rapidly pushed tens of thousands of fake packages to the npm registry. Reports described the scale as at least 46,000 packages, with some coverage placing the total near 100,000.
An automated package-publication operation using the 'IndonesianFoods' naming pattern began flooding the npm ecosystem with large numbers of packages. The activity was linked by researchers to a crypto reward-farming scheme rather than a conventional software supply-chain attack.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesnyk.io
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale attack on the NPM (Node Package Manager) ecosystem has been uncovered, involving the publication of over 64,000 malicious packages by a coordinated group known as the IndonesianFoods worm. This campaign, active for more than two years, leveraged at least seven newly created NPM user accounts to distribute the malicious packages, which are notable for their consistent naming patterns and unusual internal dictionary. The attackers focused on creating new packages rather than stealing credentials, and the scale of the operation more than doubles the previously known number of malicious NPM packages. Security researchers have made available a comprehensive list of the affected packages and user accounts for further analysis. In a separate but related incident, researchers identified a highly popular fake NPM package, "@acitons/artifact," which was downloaded over 206,000 times. This package used a typosquatting technique to mimic the legitimate GitHub Actions Toolkit and was designed to steal GitHub credentials by executing a malicious post-install script. The attack highlights the growing threat of software supply chain compromises, with the malicious package aiming to exfiltrate tokens from build environments and potentially publish further malicious artifacts. Both incidents underscore the increasing sophistication and scale of supply chain attacks targeting the JavaScript development community.
Jun 29, 2026
A significant surge of auto-generated packages with names following the pattern `elf-stats-*` was detected on the npm registry, with new variants appearing approximately every two minutes. These packages, often published from newly created accounts, contained simple but potentially harmful code, including scripts that could exfiltrate data or establish reverse shells. Some package descriptions referenced automated generation, capture the flag challenges, or testing, and the rapid publishing cadence matched these claims. The Socket Threat Research Team identified at least 420 unique packages in this campaign, and npm began removing the affected packages as the incident unfolded. Examples of the malicious code included the use of Node.js `child_process.exec` to run commands that send encoded directory listings to external servers, and `preinstall` scripts in `package.json` designed to open reverse shells. The authors of these packages appeared to have no prior publishing history, suggesting the accounts were created solely for this activity. The incident highlights ongoing risks of supply chain attacks and the need for vigilance in monitoring public package repositories for automated or suspicious uploads.
Jun 29, 2026
Researchers linked a threat actor tracked as **RED-LILI** to a large-scale software supply chain attack that pushed nearly **800 malicious packages** to the **npm** registry in a burst of activity over roughly a week. Checkmarx reported the operation began around February 23, 2022, and relied on a highly automated pipeline that created a separate npm account for each package, complicating bulk detection and takedown efforts. The campaign used custom Python tooling, Selenium, and the open-source **Interactsh** project to automate account creation and bypass npm email one-time-password verification during signup. The malicious packages were part of a broader effort to compromise developers and downstream environments through common package ecosystem abuse techniques, including **typosquatting** and **dependency confusion**. Reporting tied the activity to packages crafted to target organizations such as **Azure, Uber, and Airbnb**, underscoring how attackers can industrialize package publication at scale and turn open-source repositories into an efficient delivery channel for supply chain compromise.
Aug 15, 2026