150,000 Packages Flood NPM Registry in Token Farming Campaign

Darkreading •Rob Wright • November 14, 2025

Share: View original

A self-replicating attack led to a tidal wave of malicious packages in the NPM registry, targeting tokens for the tea.xyz protocol.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Over 150,000 Malicious npm Packages Flood Registry in Token Farming Attack A coordinated token farming campaign has resulted in over 150,000 malicious packages flooding the npm registry, targeting the tea.xyz protocol. Discovered by Amazon Inspector researchers, this incident is described as one of the largest package flooding events in open source history, surpassing previous incidents. The attack utilizes self-replicating packages to exploit unsuspecting developers. 5 sources 21

Extracted Entities

Attack Types (1)

Supply Chain Attack

Domains (1)

Malware (1)

Platforms (1)

Tea.xyz Protocol

Tools (1)