Over 46,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

Cybersecurity researchers have flagged a large-scale spam campaign that has flooded the npm registry with thousands of fake packages since early 2024, with as many as 46,484 packages identified so far, according to SourceCodeRED security researcher Paul McCarty. The activity—named IndonesianFoods—uses a worm-like propagation, publishing from a small network of over a dozen npm accounts and employing a single JavaScript file (for example, auto.js) that stays dormant until a user runs it manually with node auto.js.

The campaign’s end goal appears to be monetisation rather than data theft, and it can push about 12 packages per minute, equating to around 17,000 per day, by repeatedly publishing new junk packages in an infinite loop. Endor Labs notes that the same attackers have crafted a self-replicating network of dependencies so that installing one package drags in the entire dependency tree, thereby straining registry bandwidth.

GitHub has removed the malicious packages in line with its policies, emphasising that automated detection and human review remain essential as security scanners historically flag only lifecycle events during installation.