Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign

Amazon says more than 150,000 malicious NPM packages were published in a spam campaign linked to a self-replicating worm, expanding a previously reported total of about 80,000 packages across 18 accounts. The activity, identified between 24 October and 12 November, ties all packages to tea[.]xyz, a blockchain-based system that rewards open source developers with a native cryptocurrency token.

Each package lacks legitimate functionality but contains a self-replicating routine to create more packages, modify their package.json files to make them public, and publish them to the NPM registry. A configuration file named tea.yaml is likely intended to boost visibility and page rank so the threat actor can extract rewards from the tea[.]xyz protocol, with the packages linked to blockchain wallet addresses.

The campaign, tracked as IndonesianFoods and Big Red, pollutes the registry with low‑quality, non‑functional packages and wastes infrastructure resources, posing a risk to developers who download the code, according to Amazon notes.