A financially motivated threat actor automated the package publishing process in a coordinated tea.xyz token farming campaign.

The post Amazon Detects 150,000 NPM Packages in Worm-Powered Campaign  appeared first on SecurityWeek.

The spam campaign is likely orchestrated by an Indonesian threat actor, based on code comments and the packages’ random names.

The post Tens of Thousands of Malicious NPM Packages Distribute Self-Replicating Worm appeared first on SecurityWeek.