IndonesianFoods Spam Campaign: What Security Teams Need To Know

A large-scale spam campaign in the npm ecosystem, known as IndonesianFoods, used full automation to push thousands of packages into the registry at very short intervals, and by mid November 2025 it had become fully visible to the security community. Researcher Paul McCarty was among the first to highlight the problem after identifying 86,000 spam packages linked to at least 11 fake accounts, a finding that spurred a broader investigation by researchers and npm maintainers.

Across the campaign, tens of thousands of packages were created that provided no real functionality, with the aim of polluting the registry and distorting trust signals rather than stealing credentials or delivering malware. By late 2025 the campaign had already released more than 150,000 spam packages, representing nearly 1% of the entire registry, with each upload coming from fabricated maintainer accounts and containing no meaningful source code.

The threat actor’s approach—extreme volume, random Indonesian naming paired with food terms, and automatic publishing scripts—forms a latent supply chain threat that could enable future malicious updates or payloads.