The eko-moci96-sluey npm package is part of a malicious campaign linked to the tea.xyz token reward scheme. It contains autopublish scripts that automatically generate and publish numerous derivative packages with randomized names. These packages modify their own package.json files to remove private flags and alter version numbers, enabling continuous republishing to inflate developer reputation scores and pollute the npm registry.