IndonesianFoods NPM worm campaign floods NPM registry

Rafi Mahmood

Observed in the wild

• On 11 November, SourceCodeRed reported a massive NPM worm dubbed IndonesianFoods, which published over 85,000 malicious packages to the NPM registry. The attack focuses on flooding the ecosystem with junk packages rather than credential theft, more than doubling the known number of malicious NPM packages.
• The campaign exhibits long-term coordination, active for over two years, and uses at least sixty NPM accounts. Packages share consistent naming patterns based on Indonesian names and food terms, and employ a shared internal dictionary, suggesting a unified strategy.
• The malware automates package creation and publishing, generating random names, modifying package.json to force public visibility, assigning random versions, and publishing a new package every 7 seconds in an infinite loop. It masquerades as a legitimate Next.js application to evade detection. While it does not steal data, it weaponises the NPM registry, polluting search results and creating supply chain risk.
• Organisations are advised to audit dependencies, monitor for packages from identified accounts, implement web content filtering to block access to the malicious packages, and use lock files and dependency pinning to prevent accidental installation of compromised packages.

NPM Worm IndonesianFoods Publishes 64k Packages Threat - SourceCodeRed