MalwarePublished 10 Nov 2025

eka-jamblang10-sukiwir (npm) · Malicious Code

Affects eka-jamblang10-sukiwirSource GCVE Database

Malicious package : remove eka-jamblang10-sukiwir and rotate any secrets on hosts that installed it.

Data as of 5 Nov 2026, 08:04 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-51632

What to do

Remove eka-jamblang10-sukiwir from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmeka-jamblang10-sukiwir	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package eka-jamblang10-sukiwir is part of a large-scale malicious campaign linked to the tea.xyz token reward system. It contains malicious code that automatically modifies package metadata and republishes numerous derivative packages with randomized Indonesian-themed names. This activity inflates developer reputation scores fraudulently and pollutes the npm registry with spam packages.

Impact

This malicious package enables fraudulent inflation of developer reputation scores within the tea.xyz token reward system and contributes to significant pollution of the npm package registry. While no direct exploitation or damage to end-user systems is described, the integrity and trustworthiness of the npm ecosystem are compromised by the mass publication of spam packages.

Defensive guidance

Users and maintainers should avoid using the affected package and related variants. Registry maintainers should consider removing these spam packages and monitoring for similar autopublish scripts. Since this is a malicious package rather than a vulnerability in software, remediation involves blocking and removing the malicious content rather than patching.

Summary

The package eka-jamblang10-sukiwir was identified as containing malicious code associated with the tea.xyz token reward campaign, which flooded npm with over 15,000 spam packages in 2024. The malicious payload includes autopublish scripts that modify package.json files to remove private flags, alter version numbers, and generate random Indonesian-themed package names. These scripts continuously republish variants to manipulate developer reputation scores and degrade the integrity of the npm ecosystem.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 08:04 UTC

Technical details

Community reviews