The npm package hanafi-rawon64-sluey is part of a malicious campaign linked to tea.xyz token rewards that floods the npm registry with autopublish scripts. These scripts automatically generate and publish derivative packages with randomized names, often Indonesian-themed, to inflate developer reputation scores. The malicious payload modifies package.json files to remove private flags and alters version numbers, enabling continuous republishing of variants and polluting the npm ecosystem.