Last year's Tea-protocol spam (https://blog.phylum.io/the-great-npm-garbage-patch/) wave on npm left a huge mess in the ecosystem. Thousands of packages were published to chase incentives.

Recently, while digging into the new "IndonesianFoods" npm worm, we noticed something familiar. Several of the accounts involved look a lot like the ones active during the Tea-spam days back in 2024. Same patterns, publishing style, and abandoned namespaces quietly sitting there.

What's happening now feels like a continuation of the same problem with new tooling and new naming conventions.

The old, forgotten spam is now being reused as groundwork for new campaigns.

It's a reminder that leaving junk packages in a registry isn't harmless. They don't just sit there. They can eventually be picked up, repurposed, or automated into the next wave of nonsense (or worse).

Veracode called out this issue early on, if we don't clean up the pollution in these ecosystems, we end up building on top of it.