Massive Spam Attack Floods npm Registry with Over 43,000 Packages
In a significant cybersecurity incident, the npm registry has been inundated with over 43,000 spam packages, a campaign that remained undetected for nearly two years. Security researcher Paul McCarty identified this extensive operation, now referred to as the IndonesianFoods worm, which has compromised more than one percent of the entire npm repository.
The Scale and Strategy of the Attack
The attackers employed a systematic approach, utilizing at least eleven user accounts to publish the spam packages. A single execution of their malicious script could release approximately twelve packages per minute, totaling around 720 per hour or an astonishing 17,000 per day. This rapid deployment underscores the efficiency and scale of the operation.
Naming Conventions and Camouflage
To blend seamlessly into the npm ecosystem, the attackers adopted a naming scheme combining common Indonesian names such as andi and budi with food-related terms like rendang and sate, followed by random numbers and suffixes like -kyuki or -breki. Examples include package names like zul-tapai9-kyuki and andi-rendang23-breki. This strategy not only obfuscated the malicious intent but also made the packages appear legitimate at first glance.
Deceptive Package Content
Each spam package was meticulously crafted to resemble a standard Next.js project, complete with proper configuration files, legitimate dependencies such as React and Tailwind CSS, and professional documentation. The malicious component was concealed within hidden script files named auto.js or publishScript.js, which remained dormant and unreferenced within the package structure, evading detection during routine inspections.
Exploitation of the TEA Protocol
ENDOR Labs security analysts linked these packages to an attack first described in April 2024, where attackers exploited the TEA protocol designed to reward open-source contributions. By manipulating this system, the attackers monetized their spam campaign, earning cryptocurrency rewards through artificial ecosystem value. Notably, at least one maintainer appeared to be an Indonesian software engineer, providing insight into the regional specificity of this operation.
Self-Replicating Mechanism and Dependency Chains
The IndonesianFoods worm exhibited a particularly insidious spreading mechanism through dependency chains. When the malicious script was executed manually—triggered by commands like node auto.js—it performed several actions:
1. Removal of Protective Flags: The script removed the private: true flag from package.json files, a safeguard developers use to prevent accidental publication of proprietary code.
2. Version Number Manipulation: It generated random version numbers like 2.3.1 to bypass npm’s duplicate detection systems.
3. Automated Publishing: The script updated the package.json and package-lock.json files, then executed npm publish –access public to flood the registry with new packages on a seven to ten-second cycle.
This method allowed each spam package to reference eight to ten additional spam packages as dependencies. Consequently, when developers installed one contaminated package, npm automatically fetched its entire dependency tree, potentially pulling in over a hundred related spam packages. This cascading effect exponentially increased the spread of malicious packages across the registry.
Potential for Malicious Code Injection
Some of these packages accumulated thousands of weekly downloads, creating opportunities for attackers to inject actual malicious code in future updates. This scenario poses a significant risk, as widespread installations could be compromised simultaneously, leading to extensive security breaches.
Financial Motivation and Cryptocurrency Rewards
The monetization aspect through TEA token rewards highlights the financial incentives driving this coordinated operation. Some packages openly displayed their earned token amounts in their documentation, reinforcing the attackers’ motivation to exploit the open-source ecosystem for financial gain.
Implications for the Open-Source Community
This incident underscores the vulnerabilities within open-source repositories and the need for enhanced security measures. Developers and organizations must exercise increased vigilance when incorporating third-party packages, implementing thorough vetting processes, and utilizing automated tools to detect and mitigate such threats.
Conclusion
The IndonesianFoods worm serves as a stark reminder of the evolving tactics employed by cybercriminals to exploit trusted platforms. The open-source community must collaborate to strengthen defenses, share threat intelligence, and foster a culture of security awareness to safeguard the integrity of software development ecosystems.
