Poisoned Pipeline / Incidents / AS42
IndonesianFoods npm worm (86k+ packages)
OpenSourceMalware identified an npm worm that published at least 86,583
packages across 60 user accounts, more than doubling the then-known
malicious-package count. Accounts were created for the campaign rather
than hijacked. The payload auto-publishes further packages (auto.js /
publishScript.js) and pollutes search/infrastructure; it is a volume
worm, not a credential stealer. Named for the internal Indonesian-food
dictionary. Package list is in 6mile/Indonesian-Foods-Worm.
Mapped techniques
- T0108 Accounts in public registry
- T0109 Publish malicious artifact
- T0110 Advertise malicious artifact
- T0169 Push implants across repositories
supply-chain npm registry
Sixty purpose-created npm users, several with 5,250 packages each.
86k+ packages published over a multi-year staging period.
Search-result pollution so a human might install one by accident.
Worm scripts publish the next generation of packages from the install.