IndonesianFoods Worm Publishes 86,000+ Malicious NPM Packages

#### Executive summary The IndonesianFoods worm is a long-running coordinated campaign that has published over 86,500 algorithmically generated malicious NPM packages from dozens of attacker-created accounts, flooding the registry, polluting search results, and creating supply-chain risks; the operators also manipulated TEA Protocol manifests to monetize the campaign, though the payload is described as primarily publishing spam rather than stealing credentials.