Over 150,000 Malicious npm Packages Flood Registry in Token Farming Attack

First seen 15 Nov 2025, 09:32 UTC • Aws.Amazon

•81% similarity •21

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A coordinated token farming campaign has resulted in over 150,000 malicious packages flooding the npm registry, targeting the tea.xyz protocol. Discovered by Amazon Inspector researchers, this incident is described as one of the largest package flooding events in open source history, surpassing previous incidents. The attack utilizes self-replicating packages to exploit unsuspecting developers.

ThreatCluster AI How this analysis works

Attack Flow

12 entities, 13 inferred relationships (STIX 2.1).

Technique (2)

Malware
Supply Chain Attack

Campaign (1)

Tea.xyz Token Farming Campaign

Indicator (1)

tea.xyz

Malware (2)

IndonesianFoods
Shai-hulud

Affected Platform (3)

Npm Registry
PyPI
Tea.xyz Protocol

Tool (3)

Npm
Maloss
Opensourcemalware.com

Relationships

IndonesianFoods communicates with tea.xyz
Shai-hulud communicates with tea.xyz
Tea.xyz Token Farming Campaign uses IndonesianFoods
Tea.xyz Token Farming Campaign uses Shai-hulud
Malware targets Npm Registry
Malware targets PyPI
Malware targets Tea.xyz Protocol
Supply Chain Attack targets Npm Registry
Supply Chain Attack targets PyPI
Supply Chain Attack targets Tea.xyz Protocol
Tea.xyz Token Farming Campaign related to Npm
Tea.xyz Token Farming Campaign related to Maloss
Tea.xyz Token Farming Campaign related to Opensourcemalware.com

Community

Browse all →

Tracked Entities in This Story

IndonesianFoods Shai-hulud Tea.xyz Token Farming Campaign Npm Registry PyPI Tea.xyz Protocol

Over 150,000 Malicious npm Packages Flood Registry in Token Farming Attack

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story