MalwarePublished 10 Nov 2025

dewi-donat81-breki (npm) · Malicious Code

Affects dewi-donat81-brekiSource GCVE Database

Malicious package : remove dewi-donat81-breki and rotate any secrets on hosts that installed it.

Data as of 5 Nov 2026, 07:57 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-51507

What to do

Remove dewi-donat81-breki from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdewi-donat81-breki	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dewi-donat81-breki contains malicious code linked to a large-scale spam campaign flooding the npm registry with over 15,000 packages. These packages include autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The malicious payload manipulates package metadata by removing private flags and altering version numbers to continuously republish variants, aiming to inflate developer reputation scores for the tea.xyz token reward campaign.

Impact

This malicious package pollutes the npm ecosystem by flooding it with spam packages, which can degrade the quality and trustworthiness of the registry. It manipulates package metadata to bypass restrictions and repeatedly publishes variants, potentially misleading developers and automated systems relying on reputation scores. While no direct exploitation or code execution impact is described, the campaign undermines the integrity of the npm package ecosystem and associated token reward mechanisms.

Defensive guidance

Users and organizations should avoid installing the dewi-donat81-breki package and other related spam packages. Registry maintainers and npm administrators should continue to identify and remove these spam packages to preserve ecosystem integrity.

Summary

The dewi-donat81-breki npm package is part of a widespread malicious campaign associated with tea.xyz token rewards. It contains autopublish scripts (such as auto.js and autopublish.js) that automate the creation and publication of numerous derivative packages with randomized names. The payload modifies package.json files by removing private flags and changing version numbers to enable repeated publication of variants. This activity pollutes the npm registry and artificially inflates developer reputation scores within the tea protocol ecosystem.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 07:57 UTC

Technical details

Community reviews