Tens of Thousands of Malicious NPM Packages Distribute Self-Replicating Worm

Security researchers warn that tens of thousands of malicious NPM packages have been published containing a self-replicating worm. According to SourceCodeRed, the activity is likely orchestrated by an Indonesian threat actor, and they identified over 43,900 malicious NPM packages linked to 11 accounts.

The malware, dubbed the IndonesianFoods worm by SourceCodeRed, generates random package names and publishes them publicly to the NPM registry, with the code repeating the process in an infinite loop and creating a new package every seven seconds. According to JFrog, more than 80,000 self-replicating packages were observed, published across 18 user accounts, all containing the self-replicating publishing logic and using a similar random name scheme.

JFrog also named the campaign Big Red and noted the malware reuses a victim user’s stored NPM credentials to publish new packages at a rapid pace. The exact purpose remains unclear, but researchers say it could be a dry run for deploying real malicious payloads in future campaigns. This activity was reported on 13 November 2025.