IndonesianFoods Worm Floods npm with Over 100,000 Spam Packages

Thecyberexpress

IndonesianFoods Worm Floods npm with Over 100,000 Spam Packages

First seen 2 Dec 2025, 18:33 UTC • •26.9

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

A large-scale spam campaign, known as the IndonesianFoods worm, has inundated the npm registry with over 100,000 spam packages. This campaign, which has been ongoing for more than two years, utilizes at least 11 accounts to publish packages that do not contain malicious code but significantly pollute the registry. The packages are named using random Indonesian food terms, contributing to the campaign's unique identity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 228d ago How this analysis works

More articles in this cluster (4)

Threat Graph

16 entities, 38 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Supply Chain Attack
Worm

Campaign (3)

IndonesianFoods Campaign
IndonesianFoods Npm Spam Campaign
Shai Hulud Campaign

Organization (1)

OpenVSX

Malware (5)

IndonesianFoods
Glassworm
Indonesian Foods Worm
IndonesianFoods Worm
Shai-hulud

Tool (3)

Npm
Auto.js
PublishScript.js

Vulnerability (2)

FortiWeb
Imunify360

Relationships

IndonesianFoods exploits FortiWeb
IndonesianFoods exploits Imunify360
Glassworm exploits FortiWeb
Glassworm exploits Imunify360
Indonesian Foods Worm exploits FortiWeb
Indonesian Foods Worm exploits Imunify360
IndonesianFoods Worm exploits FortiWeb
IndonesianFoods Worm exploits Imunify360
Shai-hulud exploits FortiWeb
Shai-hulud exploits Imunify360
Npm exploits FortiWeb
Npm exploits Imunify360
Auto.js exploits FortiWeb
Auto.js exploits Imunify360
PublishScript.js exploits FortiWeb
PublishScript.js exploits Imunify360
IndonesianFoods Campaign uses IndonesianFoods
IndonesianFoods Campaign uses Glassworm
IndonesianFoods Campaign uses Indonesian Foods Worm
IndonesianFoods Campaign uses IndonesianFoods Worm
IndonesianFoods Campaign uses Shai-hulud
IndonesianFoods Npm Spam Campaign uses IndonesianFoods
IndonesianFoods Npm Spam Campaign uses Glassworm
IndonesianFoods Npm Spam Campaign uses Indonesian Foods Worm
IndonesianFoods Npm Spam Campaign uses IndonesianFoods Worm
IndonesianFoods Npm Spam Campaign uses Shai-hulud
Shai Hulud Campaign uses IndonesianFoods
Shai Hulud Campaign uses Glassworm
Shai Hulud Campaign uses Indonesian Foods Worm
Shai Hulud Campaign uses IndonesianFoods Worm
Shai Hulud Campaign uses Shai-hulud
IndonesianFoods targets OpenVSX
Glassworm targets OpenVSX
Indonesian Foods Worm targets OpenVSX
IndonesianFoods Worm targets OpenVSX
Shai-hulud targets OpenVSX
IndonesianFoods Campaign related to Supply Chain Attack
IndonesianFoods Campaign related to Worm

Following this threat?

Track IndonesianFoods and OpenVSX in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…