Yet another supply chain attack has hit the npm registry in what Amazon describes as "one of the largest package flooding incidents in open source registry history" - but with a twist. Instead of injecting credential-stealing code or ransomware into the packages, this one is a token farming campaign. Amazon Inspector security researchers, using a new detection rule and AI assistance, originally spotted the suspicious npm packages in late October, and, by November 7, the team had flagged thousands. By November 12, they had uncovered more than 150,000 malicious packages across "multiple" developer accounts. These were all linked to a coordinated tea.xyz token farming campaign, we're told. This is a decentralized protocol designed to reward open-source developers for their contributions using the TEA token, a utility asset used within the tea ecosystem for incentives, staking, and governance. Unlike the spate of package poisoning incidents over recent months, this one didn't inject traditional malware into the open source code. Instead, the miscreants created a self-replicating attack, infecting the packages with code to automatically generate and publish, thus earning cryptocurrency rewards on the backs of legitimate open source developers. The code also included tea.yaml files that linked these packages to attacker-controlled blockchain wallet addresses. Meanwhile, users were completely unaware that they were unwittingly padding the attackers' wallets. "This incident demonstra...
Crims poison 150K+ npm packages with token-farming malware
The Register
·Jessica Lyons
·Published Nov 14, 2025
·Updated
Affected Software
1 affected component
npm registry
Frequently Asked Questions
1
What is the main topic of this article?
The article discusses a large supply chain attack that has compromised over 150,000 npm packages with token-farming malware.
2
What security implications are discussed?
The implications include the risk of compromised open source software supply chains leading to widespread malware distribution.
3
What products or software are affected?
The npm registry and its packages are primarily affected by this incident.
4
Who reported on this supply chain attack?
The attack was reported by Amazon, describing it as one of the largest package flooding incidents in open source history.
5
What type of malware is involved in this supply chain attack?
The malware involved is token-farming malware, which targets resources for illicit gains.