New ‘IndonesianFoods’ worm floods npm with 100,000 packages

A large-scale automated spam campaign dubbed “IndonesianFoods” has been publishing tens to hundreds of thousands of junk packages to the npm registry (100k–150k reported), using auto-publishing and self-replication techniques and monetizing via the TEA Protocol; although the packages currently lack overt malware, the campaign overwhelms security systems, creates massive advisories, and poses a material supply-chain risk if attackers later introduce malicious payloads.