# Automated Package-Publication Incident IndonesianFoods in the NPM Ecosystem Linked to Crypto Reward-Farming Scam

DevFeed: [Automated Package-Publication Incident IndonesianFoods in the NPM Ecosystem Linked to Crypto Reward-Farming Scam](<https://devfeed.tech/articles/automated-package-publication-incident-indonesianfoods-in-the-npm-ecosystem-linked-to-crypto-reward-farming-scam-7834.md>)

Original publisher: [Read original article](<https://snyk.io/blog/automated-package-publication-incident-indonesianfoods/>)

Author: Stephen Thoemmes

Published: 2025-11-13T05:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>), [Boilerplate](<https://devfeed.tech/topics/boilerplate.md>)

Tags: [automation](<https://devfeed.tech/tags/automation.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [developer](<https://devfeed.tech/tags/developer.md>), [ecosystem](<https://devfeed.tech/tags/ecosystem.md>), [incident](<https://devfeed.tech/tags/incident.md>), [next-js](<https://devfeed.tech/tags/next-js.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [publication](<https://devfeed.tech/tags/publication.md>), [scam](<https://devfeed.tech/tags/scam.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-code](<https://devfeed.tech/tags/snyk-code.md>), [snyk-container](<https://devfeed.tech/tags/snyk-container.md>), [snyk-iac](<https://devfeed.tech/tags/snyk-iac.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

## AI overview

The article examines a large-scale surge of similarly structured NPM package publications linked to a dormant automation script associated with a cryptocurrency reward-farming scheme. It reports no verified active exploit and says the packages currently pose minimal risk, while emphasizing dependency hygiene and registry safeguards.

## Source excerpt

In November 2025, a large-scale surge of package publications on the NPM registry with similar structures and naming patterns was discovered. Understand the details of the incident.