Skip to content
IndonesianFoods Worm Infects npm with Over 44,000 Malicious Packages

IndonesianFoods Worm Infects npm with Over 44,000 Malicious Packages

First seen 13 Nov 2025, 17:30 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster March 12, 2026 at 13:27 UTC

A large-scale spam campaign known as the IndonesianFoods worm has targeted the npm ecosystem, deploying over 43,000 malicious packages across at least 11 user accounts. This attack, which has been ongoing for more than two years, aims to pollute the npm registry with junk packages rather than stealing user credentials or data.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 182d ago How this analysis works

More articles in this cluster (2)

Following this threat?

Track IndonesianFoods in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed