Supply chain · npm · High

Malicious npm Package 'ida-gado-gado47-ruro' Floods Registry with Junk

Threat Engine Auto-Feed · data current as of 2026-09-13

The npm package 'ida-gado-gado47-ruro' contains malicious code designed to generate and publish numerous derivative packages with randomized names. This activity aims to inflate developer reputation scores for token rewards, polluting the npm registry with junk packages. While not directly stealing credentials, its presence indicates a compromised build process and contributes to registry noise.

  • Package: npm / ida-gado-gado47-ruro
  • Affected versions: > 0
  • Severity: critical
  • Reach: ~1/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'ida-gado-gado47-ruro' was identified as containing malicious code. This code modifies the package.json file, specifically removing private flags and changing version numbers. It then generates new, randomly named packages, often with Indonesian-themed names, and continuously republishes these variants to the npm registry.

How the attack works

This attack leverages automated scripts within the package to manipulate metadata and self-replicate. The malicious code modifies package configuration files and then uses automated publishing mechanisms to flood the package registry with numerous derivative packages. This strategy aims to exploit reward campaigns by artificially inflating developer metrics through high publication volume.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest package versions
  • Teams that rely on internal package mirrors without strict vetting

Conditions that increase exposure

  • Direct or transitive dependency on 'ida-gado-gado47-ruro'
  • Using package versions greater than 0
  • Lack of package lockfiles (e.g., package-lock.json, yarn.lock)
  • Automated builds that do not vet new package versions

Blast-radius scenarios

  • Installation of the package leads to modification of local package.json files.
  • The compromised build environment may attempt to republish modified packages, contributing to registry pollution.
  • Increased build times and resource consumption due to unexpected package generation and publishing attempts.

What to do (defensive)

Detect

  • Scan project dependencies for 'ida-gado-gado47-ruro' using dependency scanning tools.
  • Monitor npm registry activity for unexpected package publications originating from your build environments.
  • Review package.json files for unauthorized modifications, especially removal of 'private' flags or unexpected version changes.

Contain

  • Immediately quarantine any build environments or developer machines found to have installed 'ida-gado-gado47-ruro'.
  • Block 'ida-gado-gado47-ruro' and its known variants from being pulled into your environments via package managers or proxies.
  • Implement strict package version pinning (e.g., using package-lock.json) to prevent automatic updates to malicious versions.

Remediate

  • Remove 'ida-gado-gado47-ruro' from all project dependencies.
  • Revert any unauthorized changes to package.json files in affected projects.
  • Rebuild affected applications and services from a clean, trusted state, ensuring all dependencies are verified.

Frontier verdict — High

Prioritize immediate removal and blocking of 'ida-gado-gado47-ruro' to prevent registry pollution and maintain build integrity.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.