Hackers Infiltrate npm Registry with 43,000 Spam Packages, Linger for Nearly Two Years

Security researchers have uncovered a massive spam campaign aimed at the npm ecosystem, dubbed the IndonesianFoods worm, which comprises over 43,000 malicious packages published across at least 11 user accounts and remained active for nearly two years. The campaign uses a distinctive naming scheme that blends Indonesian given names with food terms, producing examples such as “zul-tapai9-kyuki” and “andi-rendang23-breki,” and utilises a random versioning approach like “2.3.1” to bypass duplicate version checks.

Each infected package contains a Next.js project structure with legitimate dependencies, while a dormant script (auto.js or publishScript.js) evades automated scanners until executed, after which it removes the private flag from package.json, generates new random versions, and publishes additional packages in an infinite loop—roughly 12 packages per minute, 720 per hour, or 17,000 per day.

The spam network propagates via dependency chains, so installing one package can trigger downloads of 8–10 more, multiplying registry bandwidth usage and complicating cleanup. Some attacker-controlled packages include “tea.yaml” files listing TEA accounts and token earnings, and at least one maintainer appears to have a LinkedIn profile; eleven compromised accounts to verify are voinza, yunina, noirdnv, veyla, vndra, vayza, bipyruss, sernaam.b.y, jarwok, doaortu, and rudiox.