Amazon researchers uncover major token farming malware scam - over 150,000 malicious packages found

Open source software.

• Over 150,000 npm packages linked to a TEA token farming scheme were flagged by Amazon Inspector
• Attackers used self-replicating spam packages to fake developer impact and earn crypto rewards
• Researchers call it a major supply chain security event, urging stronger registry defenses and collaboration

Researchers have found tens of thousands of self-replicating, yet seemingly pointless, npm packages, which appear to be part of a large-scale fraud operation looking to earn crypto tokens for the fraudsters.