Malicious code in photon-darkenergy-mocha-terraforming (npm)
Exact source revision recorded 24 Oct 2026 13:17:17 UTC. It does not establish the source's current position. Latest evidence.
osv · MAL-2025-188687
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d6ce42babb790cecb786467b5307818ca1b0a573a280616ec3b158591c55da0b) This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names to inflate developer reputation scores for tea protocol token rewards. The malicious payload modifies package.json to remove private flags, changes version numbers, generates random Indonesian-themed package names (some variants are also in English), and continuously republishes variants to pollute the npm registry.
- Source published
- 13 Nov 2025 03:23:14 UTC
- Source modified
- 13 Nov 2025 03:23:14 UTC
- Observed here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.