MalwarePublished 12 Nov 2025

kisut-faig-iani (npm) · Malicious Code

Affects kisut-faig-ianiSource GCVE Database

Malicious package : remove kisut-faig-iani and rotate any secrets on hosts that installed it.

Data as of 12 Nov 2026, 20:42 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-179711

What to do

Remove kisut-faig-iani from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmkisut-faig-iani	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The kisut-faig-iani npm package is part of a malicious campaign linked to tea.xyz token rewards that floods the npm registry with autopublished derivative packages. These packages contain scripts that automatically generate and publish new variants with randomized names, modifying package metadata to remove privacy flags and increment version numbers. The intent is to inflate developer reputation scores by continuously republishing numerous variants, thereby polluting the npm ecosystem.

Impact

The malicious package pollutes the npm registry by flooding it with numerous derivative packages, which can degrade the quality and trustworthiness of the npm ecosystem. It manipulates package metadata to bypass privacy settings and repeatedly publishes variants, potentially misleading users and automated systems that rely on package reputation. There is no indication of direct code execution exploits or data breaches from this package, but the ecosystem integrity is compromised.

Defensive guidance

Mitigation involves avoiding installation of the kisut-faig-iani package and its derivatives. Registry maintainers and security teams should monitor for and remove such autopublished malicious packages to preserve ecosystem integrity. Users should verify package provenance and avoid packages linked to the tea.xyz token reward campaign.

Summary

This threat involves the kisut-faig-iani npm package, which is associated with the tea.xyz token reward campaign. The package contains autopublish scripts (e.g., auto.js, autopublish.js) that automatically create and publish derivative packages with randomized Indonesian-themed or English names. The malicious payload modifies package.json files by removing private flags and changing version numbers to enable repeated publication. This behavior results in a flood of packages in the npm registry, aiming to manipulate developer reputation scores for the tea protocol token rewards system.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Nov 2026, 20:42 UTC

Technical details

Community reviews