Since early 2024, a coordinated spam campaign has systematically flooded the npm registry with over 46,000 fake packages, collectively known as IndonesianFoods. These packages masquerade as legitimate Next.js projects and contain a single JavaScript file (e.g., "auto.js" or "publishScript.js") that remains dormant until manually executed by a user. This design evades detection by automated security scanners that monitor lifecycle hooks or installation-time behaviors. When run, the script enters an infinite loop that removes the "private": true flag from package.json to allow publication, generates a random package name and version, and publishes a new junk package every 7 to 10 seconds. This worm-like self-replicating mechanism has persisted for nearly two years, with packages referencing each other as dependencies, creating an exponentially growing dependency tree that strains npm registry bandwidth and infrastructure. The campaign’s motivation appears financial, as some packages include tea.yaml files linked to the Tea protocol, a decentralized developer reward system, suggesting attackers inflate their impact scores to earn tokens. Despite the scale, the attack does not involve credential theft or direct code injection into developer environments. The campaign exploits npm’s open publishing model and highlights a security blind spot where dormant malicious code evades detection until manually triggered. GitHub has removed the malicious packages and is enhancing detection capabilities, but the incident underscores the challenges in securing large open-source ecosystems against automated, large-scale abuse.

For European organizations, this campaign poses significant supply chain risks. Developers may inadvertently install these fake packages, leading to polluted dependency trees that degrade software quality and increase build times. The exponential dependency fetching caused by interlinked spam packages can strain internal CI/CD pipelines and npm registry bandwidth, potentially causing delays and outages. Although the packages do not automatically execute malicious code, manual execution—whether accidental or due to misleading documentation—could trigger the worm’s propagation, further exacerbating the problem. The campaign also wastes infrastructure resources and pollutes npm search results, complicating package discovery and increasing the risk of integrating untrusted code. Financially motivated abuse of the Tea protocol could distort open-source contribution metrics, affecting reputation and funding models. European software supply chains heavily reliant on npm, especially in countries with large developer communities and tech industries, face operational disruptions and increased security monitoring burdens. The attack highlights the need for improved vetting and monitoring of open-source dependencies to maintain software integrity and availability.

European organizations should implement advanced package vetting processes that include manual and automated analysis of package contents beyond installation scripts, focusing on dormant scripts requiring manual execution. CI/CD pipelines should avoid wildcard execution of JavaScript files (e.g., avoid commands like 'node *.js') to prevent accidental triggering of malicious scripts. Security teams should monitor dependency trees for unusual or rapidly proliferating packages, especially those with suspicious naming patterns or interdependencies. Employing internal mirrors or proxies for npm packages can help control and audit external dependencies before integration. Organizations should collaborate with npm and GitHub to report suspicious packages and stay updated on threat intelligence related to supply chain attacks. Enhancing developer awareness about the risks of running arbitrary scripts from packages and scrutinizing README instructions is critical. Finally, security tooling should evolve to detect dormant malicious code patterns and worm-like propagation behaviors, incorporating behavioral analytics and anomaly detection to identify large-scale spam campaigns early.