Thecyberexpress

IndonesianFoods Worm Floods npm with Over 100,000 Spam Packages

First seen 2 Dec 2025, 18:33 UTC • •26.9

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

A large-scale spam campaign, known as the IndonesianFoods worm, has inundated the npm registry with over 100,000 spam packages. This campaign, which has been ongoing for more than two years, utilizes at least 11 accounts to publish packages that do not contain malicious code but significantly pollute the registry. The packages are named using random Indonesian food terms, contributing to the campaign's unique identity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 182d ago How this analysis works

Threat Graph

16 entities, 38 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Supply Chain Attack
Worm

Campaign (3)

IndonesianFoods Campaign
IndonesianFoods Npm Spam Campaign
Shai Hulud Campaign

Organization (1)

OpenVSX

Malware (5)

IndonesianFoods
Glassworm
Indonesian Foods Worm
IndonesianFoods Worm
Shai-hulud

Tool (3)

Npm
Auto.js
PublishScript.js

Vulnerability (2)

FortiWeb
Imunify360

Relationships

IndonesianFoods exploits FortiWeb
IndonesianFoods exploits Imunify360
Glassworm exploits FortiWeb
Glassworm exploits Imunify360
Indonesian Foods Worm exploits FortiWeb
Indonesian Foods Worm exploits Imunify360
IndonesianFoods Worm exploits FortiWeb
IndonesianFoods Worm exploits Imunify360
Shai-hulud exploits FortiWeb
Shai-hulud exploits Imunify360
Npm exploits FortiWeb
Npm exploits Imunify360
Auto.js exploits FortiWeb
Auto.js exploits Imunify360
PublishScript.js exploits FortiWeb
PublishScript.js exploits Imunify360
IndonesianFoods Campaign uses IndonesianFoods
IndonesianFoods Campaign uses Glassworm
IndonesianFoods Campaign uses Indonesian Foods Worm
IndonesianFoods Campaign uses IndonesianFoods Worm
IndonesianFoods Campaign uses Shai-hulud
IndonesianFoods Npm Spam Campaign uses IndonesianFoods
IndonesianFoods Npm Spam Campaign uses Glassworm
IndonesianFoods Npm Spam Campaign uses Indonesian Foods Worm
IndonesianFoods Npm Spam Campaign uses IndonesianFoods Worm
IndonesianFoods Npm Spam Campaign uses Shai-hulud
Shai Hulud Campaign uses IndonesianFoods
Shai Hulud Campaign uses Glassworm
Shai Hulud Campaign uses Indonesian Foods Worm
Shai Hulud Campaign uses IndonesianFoods Worm
Shai Hulud Campaign uses Shai-hulud
IndonesianFoods targets OpenVSX
Glassworm targets OpenVSX
Indonesian Foods Worm targets OpenVSX
IndonesianFoods Worm targets OpenVSX
Shai-hulud targets OpenVSX
IndonesianFoods Campaign related to Supply Chain Attack
IndonesianFoods Campaign related to Worm

Following this threat?

Track IndonesianFoods and OpenVSX in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week 81

Weekly ALL-SOURCE Cyber Warfare Intelligence Brief September 8, 2026 78

IndonesianFoods Worm Floods npm with Over 100,000 Spam Packages

Article Content

More articles in this cluster (4)

Threat Graph

Following this threat?

Extracted Entities (17)

Attack Types (2)

Malware (5)

Campaigns (3)

Countries (1)

Vulnerabilities (2)

Tools (3)

Companies (1)

Continue Reading