OVER 67,000 FAKE NPM PACKAGES FLOOD REGISTRY IN WORM-LIKE SPAM ATTACK

Summary from the TLDR InfoSec newsletter

Cybersecurity researchers uncovered a massive spam campaign flooding npm with over 67,000 fake packages dubbed "IndonesianFoods." The worm-like attack, active since early 2024, exploits dormant JavaScript files requiring manual execution to bypass security scanners. Attackers likely monetize the campaign through the Tea protocol by artificially inflating impact scores to earn cryptocurrency tokens, while creating a self-replicating network that strains registry infrastructure and pollutes search results.