Over 150,000 Malicious npm Packages Linked to Token Farming Campaign Detected

First seen 2 Dec 2025, 18:33 UTC • Aws.Amazon

•81% similarity •8

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Amazon Inspector has reported over 150,000 malicious packages in the npm registry linked to a token farming campaign targeting developers using the Tea Protocol. This incident is noted as one of the largest package flooding events in open source history, surpassing previous reports of 15,000 packages. The campaign was identified through advanced detection methods combining AI and rule-based analysis.

ThreatCluster AI How this analysis works

Attack Flow

11 entities, 11 inferred relationships (STIX 2.1).

Technique (2)

Malware
Supply Chain Attack

Campaign (1)

Tea.xyz Token Farming Campaign

Indicator (1)

tea.xyz

Malware (1)

IndonesianFoods

Affected Platform (3)

Npm Registry
PyPI
Tea.xyz Protocol

Tool (3)

Npm
Maloss
Opensourcemalware.com

Relationships

IndonesianFoods communicates with tea.xyz
Tea.xyz Token Farming Campaign uses IndonesianFoods
Malware targets Npm Registry
Malware targets PyPI
Malware targets Tea.xyz Protocol
Supply Chain Attack targets Npm Registry
Supply Chain Attack targets PyPI
Supply Chain Attack targets Tea.xyz Protocol
Tea.xyz Token Farming Campaign related to Npm
Tea.xyz Token Farming Campaign related to Maloss
Tea.xyz Token Farming Campaign related to Opensourcemalware.com

Community

Browse all →

Tracked Entities in This Story

IndonesianFoods Tea.xyz Token Farming Campaign Npm Registry PyPI Tea.xyz Protocol

Over 150,000 Malicious npm Packages Linked to Token Farming Campaign Detected

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story