MalwarePublished 10 Nov 2025

utomo-gorengan55-riris (npm) · Malicious Code

Affects utomo-gorengan55-ririsSource GCVE Database

Malicious package : remove utomo-gorengan55-riris and rotate any secrets on hosts that installed it.

Data as of 4 Nov 2026, 19:28 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-50611

What to do

Remove utomo-gorengan55-riris from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmutomo-gorengan55-riris	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package utomo-gorengan55-riris contains malicious code linked to a large-scale spam campaign associated with the tea.xyz token reward system. This campaign flooded the npm registry with over 15,000 spam packages in 2024, using autopublish scripts to generate and publish derivative packages with randomized Indonesian-themed names. The malicious payload manipulates package metadata to remove private flags, alter version numbers, and continuously republish variants, aiming to inflate developer reputation scores and pollute the npm ecosystem.

Impact

This malicious package contributes to the pollution of the npm registry by flooding it with spam packages that can mislead developers and automated systems. It manipulates package metadata to bypass restrictions and repeatedly publishes variants, potentially undermining trust in npm packages and affecting reputation-based reward mechanisms. There is no evidence of direct exploitation or compromise of user systems, but the campaign degrades the quality and reliability of the npm ecosystem.

Defensive guidance

The recommended mitigation is to avoid using the utomo-gorengan55-riris package and related packages from the tea.xyz token reward campaign. Security teams should monitor for and block these packages in their supply chain and registry usage. Since this is a registry pollution and reputation manipulation campaign, removing or blacklisting affected packages and auditing dependencies for suspicious autopublish scripts is advised.

Summary

The utomo-gorengan55-riris npm package is part of a widespread malicious campaign that abuses the npm registry by automatically generating and publishing numerous derivative packages. These packages use autopublish scripts (e.g., auto.js, autopublish.js) to modify package.json files by removing private flags and changing version numbers, enabling continuous republishing under randomized Indonesian-themed names. This activity is designed to manipulate developer reputation scores within the tea.xyz token reward system and results in significant pollution of the npm package ecosystem.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Nov 2026, 19:28 UTC

Technical details

Community reviews