Full Report
A self-spreading package published on npm spams the registry by spawning new packages every every seven seconds, creating large volumes of junk. [...]
Analysis Summary
# Tool/Technique: IndonesianFoods Worm
## Overview
The 'IndonesianFoods' phenomenon is a self-spreading, high-volume spam campaign targeting the npm registry. Its primary purpose is not immediate malicious payload delivery but rather overwhelming the software supply chain ecosystem, potentially as a precursor to more serious attacks, and attempting to inflate scores for financial gain related to a blockchain incentive system (TEA Protocol).
## Technical Details
- Type: Worm / Spam Campaign (Logically acts as a worm due to self-replication)
- Platform: npm (Node Package Manager registry)
- Capabilities: Automated, high-frequency package publishing; worm-like replication logic; mechanism to abuse the TEA Protocol for financial gain.
- First Seen: Replication loop introduced in 2025. Initial spam attempts date back to at least September 10 (previous package named 'fajar-donat9-breki') and the campaign began two years prior to the reported spike, with 43,000 packages in 2023.
## MITRE ATT&CK Mapping
The primary focus here is on resource exhaustion, supply chain targeting, and initial access preparation, rather than direct execution on target hosts.
- [TA0011 - Command and Control]
- [T1071 - Application Layer Protocol] (If the package publication mechanism is considered a form of remote interaction/C2 establishment proxy)
- [TA0005 - Defense Evasion]
- [T1564 - Hide Artifacts] (By volume, overwhelming security systems)
- [TA0015 - Supply Chain Compromise]
- [T1195 - Supply Chain Compromise: Compromise Software Supply Chain] (Direct impact via registry flooding)
## Functionality
### Core Capabilities
- **Automated Spamming:** Spawns new packages every seven seconds, resulting in the publishing of over 100,000 packages.
- **Ecosystem Stress:** Designed to overwhelm security data systems, package managers, and vulnerability scanners (e.g., causing Amazon Inspector to flag thousands of advisories).
- **Distinctive Naming:** Packages use random Indonesian names and food terms.
### Advanced Features
- **Monetization via TEA Protocol Abuse:** Packages contain `_tea.yaml_` files listing TEA accounts and wallet addresses, suggesting an attempt to gain cryptocurrency rewards by inflating impact scores related to OSS contributions.
- **Evolving Logic:** The campaign evolved from simple package additions to implementing TEA monetization (2024) and introducing the worm-like replication loop (2025).
## Indicators of Compromise
*Note: Since this is a high-volume, transient spam campaign, specific hashes are not provided in the context, but behavioral and naming pattern indicators are key.*
- File Hashes: N/A (Focus is on registry activity, not hosted executable artifacts)
- File Names: Packages named using random Indonesian terms (e.g., 'IndonesianFoods' variants).
- Registry Keys: N/A
- Network Indicators: Package download/publication traffic to the npm registry.
- Behavioral Indicators: Extreme rate of publishing from specific npm publishers, creation of packages containing `_tea.yaml_` files listing wallet information.
## Associated Threat Actors
The article does not name a specific threat actor group, referring to them only as "the same actors" who performed a previous attempt. The motivation appears to be financial gain via protocol abuse, coupled with a potential disruption goal.
## Detection Methods
- **Signature-based detection:** Detecting packages containing specific markers related to the TEA Protocol abuse (e.g., presence of `_tea.yaml` files).
- **Behavioral detection:** Monitoring for accounts publishing packages at an extreme, automated rate (every seven seconds), indicating worm-like propagation.
- **YARA rules if available:** Rules could target the specific string patterns or filenames associated with the campaign.
## Mitigation Strategies
- **Dependency Locking:** Software developers should lock dependency versions to prevent silent updates from consuming newly published, potentially malicious versions.
- **Abnormal Pattern Monitoring:** Implement strict monitoring on package registries for abnormal publishing velocity and volume from unknown or low-reputation publishers.
- **Digital Signature Validation:** Implement strict policies for validating digital signatures on dependencies, where applicable, to ensure provenance.
- **Ecosystem Defense:** Securing the integrity of vulnerability reporting systems against systematic spamming.
## Related Tools/Techniques
- GlassWorm attack (Self-spreading malware on OpenVSX)
- Shai-Hulud worm (Used dependency confusion propagation)
- Package hijacking/squatting (e.g., chalk, debug)
This highlights a trend of **automation-based supply-chain attacks** designed to exploit ecosystem scale.