150,000 Packages Flood NPM Registry in Token Farming Campaign

Amazon Inspector researchers discovered a large-scale token-farming campaign that created more than 150,000 non-functional NPM packages linked to the tea.xyz rewards protocol. The attackers used automated tooling and circular dependency chains to self-replicate packages and inflate tea.xyz scoring, causing supply-chain pollution, infrastructure strain, and financial extraction without deploying traditional malware; Amazon and OpenSSF assigned MAL-IDs and recommended detection, auditing, and SBOM/CI/CD hardening.