Spambot filling up repos with realistic readmes and publishing to npm

[datashaman]

Hi,

While browsing packages on npm, I notice quite a few recently created packages with Lorem Ipsum names.
Looking at the packages they seem to have useful content.

This looks like an attack from spambots or possibly attempts to embed malicious code, idk.

Here's a list of users I've found so far:

https://github.com/diotoborg
https://github.com/patrtorg
https://github.com/taktikorg
https://github.com/npmtuanmap

I see some users have been removed from GitHub but the npm packages remain. npm should be contacted when GitHub removes users so that their attached packages can be removed too.

Be careful out there.

[datashaman]

• All of the accounts feature coordinated updates on their repos.
• They all have daily version changes to keep the packages recently updated.
• Most of the repos are about 5 months old, and all feature a sudden switch from no activity to heavy activity.
• The packages all have massive lists of keywords on npm.

The commits added to turn over new releases are all garbage.

npmtuanmap/ex-vel-expedita-impedit@10.13.119...10.13.120

[dmeehan1968]

Is there a way to search npm and filter out any of this stuff?

Is GitHub/npm doing anything to either expunge or limit further abuse? I still see plenty of packages with recent updates suggesting.

Searches for common terms are no unusable due to the volume of spam

[datashaman]

All of the repos have borderline fraudulent READMEs emulating a popular package.
They all have the same code in them, all of them get updated every day.
This is a coordinated attack from multiple user accounts.

[datashaman]

I've reported the packages to npm and pointed them to this thread.

[datashaman]

Perhaps this is an attempt to scam something called the tea protocol? (just learned about this).

https://docs.tea.xyz/tea/i-want-to.../learn-about-proof-of-contribution/what-is-tearank

Most if not all of the spam repos have a tea.yaml file.

[datashaman]

Here's the code which creates the nonsense commits. This is triggered by GitHub Actions on a schedule.
https://github.com/npmtuanmap/tenetur-quisquam-quia-aliquam/blob/main/.github/action/schedule.js

[PIYUSH1525]

already reported any updates guys