MalwarePublished 10 Nov 2025

utomo-otak-otak96-breki (npm) · Malicious Code

Affects utomo-otak-otak96-brekiSource GCVE Database

Malicious package : remove utomo-otak-otak96-breki and rotate any secrets on hosts that installed it.

Data as of 4 Nov 2026, 19:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-50619

What to do

Remove utomo-otak-otak96-breki from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmutomo-otak-otak96-breki	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package utomo-otak-otak96-breki contains malicious code linked to a large-scale token reward campaign that flooded npm with over 15,000 spam packages in 2024. The malicious payload includes autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. These scripts modify package.json files to remove private flags and change version numbers, enabling continuous republishing to inflate developer reputation scores and pollute the npm registry.

Impact

This malicious package enables automated mass publication of spam packages in the npm registry, which can degrade the quality and trustworthiness of the npm ecosystem. It manipulates developer reputation scores by artificially inflating package counts and versions, potentially misleading users and automated systems that rely on these metrics. While no direct exploitation or code execution beyond the publishing manipulation is described, the presence of such packages can disrupt package management and supply chain integrity.

Defensive guidance

Users and maintainers should avoid installing or depending on the utomo-otak-otak96-breki package and related derivative packages. Registry maintainers should consider removing these spam packages and enhancing detection mechanisms to prevent autopublish spam campaigns. Monitoring for packages with similar autopublish scripts and randomized naming patterns is recommended.

Summary

The utomo-otak-otak96-breki npm package is part of the tea.xyz token reward campaign's spam ecosystem. It contains autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automate the creation and publication of derivative packages with randomized names. The malicious code alters package.json by removing private flags and incrementing version numbers, facilitating repeated republishing. This behavior aims to manipulate developer reputation scores for tea protocol token rewards and results in widespread pollution of the npm registry with spam packages.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Nov 2026, 19:15 UTC

Technical details

Community reviews