IndonesianFoods Spam Campaign: 89 000 junk packages in npm
Source Kaspersky Security Blog
United States
India
Germany
United Kingdom
China
Japan
Brazil
France
Canada
Australia
Netherlands
South Korea
Russia
Poland
Turkey
Description
The IndonesianFoods campaign saw attackers flood the npm registry with junk packages. We explore how it works, and how to safeguard enterprise development.
Impact
The IndonesianFoods campaign primarily impacts software development organizations relying on npm packages by cluttering their projects with redundant and unnecessary dependencies. This bloat can degrade build performance, increase maintenance overhead, and complicate dependency management. Organizations risk reputational harm if junk packages are published under their credentials due to compromised accounts. Although no immediate malware or data breaches have been linked to this campaign, the presence of self-replicating packages and integration with blockchain reward systems indicates potential for financial fraud and future escalation into supply chain attacks. If malicious functionality is introduced in updates, affected projects and their users could face severe security breaches, including data compromise or system disruption. The campaign also stresses the npm ecosystem’s trust model, potentially undermining confidence in open-source package integrity. Enterprises with large-scale or automated dependency inclusion processes are particularly vulnerable to accidental infection. Overall, the campaign highlights systemic risks in software supply chains and the need for enhanced security controls in package management.
Defensive guidance
To mitigate risks from the IndonesianFoods campaign, organizations should implement strict dependency management policies, including: 1) Enforce use of curated internal package registries or proxies that vet packages before inclusion. 2) Employ automated tools to scan and analyze package metadata, dependencies, and behavior for anomalies or suspicious patterns, focusing on unusual dependency chains and self-replication indicators. 3) Integrate container and build environment security solutions that monitor third-party dependencies and runtime behavior to detect and block unauthorized package publishing or execution. 4) Conduct regular security awareness training for developers emphasizing the risks of typosquatting, dependency confusion, and the importance of verifying package provenance. 5) Use package integrity verification methods such as checksums and signed packages to ensure authenticity. 6) Monitor npm accounts and credentials for unauthorized activity to prevent abuse in publishing. 7) Limit automated dependency updates and require manual review for new or unknown packages. 8) Collaborate with npm and security communities to report suspicious packages and improve ecosystem-wide detection. These targeted measures go beyond generic advice by focusing on proactive detection, credential protection, and developer education tailored to the unique tactics observed in this campaign.