MalwarePublished 14 Nov 2025

Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign

Source SecurityWeek

Description

A financially motivated threat actor automated the package publishing process in a coordinated tea.xyz token farming campaign. The post Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign appeared first on SecurityWeek .

Impact

European organizations that depend on NPM packages for software development are at risk of integrating malicious code into their applications, potentially leading to unauthorized data access, system compromise, or disruption of services. The campaign’s scale increases the chance that compromised packages could be downloaded and used in production environments, affecting confidentiality, integrity, and availability of systems. Financial institutions, technology companies, and critical infrastructure operators in Europe could face operational disruptions or data breaches if malicious packages are exploited. Additionally, the campaign could erode trust in open-source software ecosystems, complicating software supply chain management. The automated nature of the attack means detection and remediation could be challenging, increasing the window of exposure. Organizations with less mature supply chain security practices are particularly vulnerable, potentially leading to cascading effects across interconnected systems and services.

Defensive guidance

European organizations should implement strict supply chain security controls, including: 1) Employing automated dependency scanning tools that detect malicious or anomalous packages before integration; 2) Using package signing and verification to ensure authenticity; 3) Restricting the use of unvetted or newly published packages, especially those with minimal usage or reputation; 4) Maintaining an allowlist of trusted packages and registries; 5) Monitoring package metadata and publication patterns for signs of automated or worm-like behavior; 6) Educating developers on the risks of supply chain attacks and encouraging minimal dependency usage; 7) Leveraging private registries or mirrors to control package sources; 8) Collaborating with NPM and security communities to report suspicious packages promptly; 9) Applying runtime application self-protection (RASP) and behavior monitoring to detect anomalous activities stemming from dependencies; 10) Regularly updating and patching development tools and environments to reduce exposure to known vulnerabilities.

References

securityweek.com/amazon-detects-150000-npm-packages-in-worm-powered-campaign/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Nov 2025, 10:42 UTC

References

Community reviews